{ "Event": { "published": true, "date": "2022-05-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-09", "timestamp": 1652140981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2a44572c-104d-45b7-bed4-c9ef32dea0f5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79103a0-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652084785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084785, "uuid": "e770b322-f2b8-4f6b-8cf0-ba690865b052", "comment": "Malware payload (SnakeKeylogger)", "value": "d80cf8daeb24033828f04adc527734b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084785, "uuid": "79fac2e1-1b1c-4cff-956f-09ea0f857197", "comment": "Malware payload (SnakeKeylogger)", "value": "001494be88645efe8ffb546bdf58b043c2dd1770091891d30c4fd317281a518a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084785, "uuid": "c576e832-15a8-46cb-aa9f-c8f95f4fde8e", "comment": "Malware payload (SnakeKeylogger)", "value": "9c0110aa8bd5617e7f81607b59d2628aa42e5a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084785, "uuid": "09ba7abe-8d8e-42c2-b32f-60a876e47fd0", "comment": "Malware payload (SnakeKeylogger)", "value": "c3db86653ef12d992eee909157239a89905d63fe8b3881cce3f2c324f5a3330108c830c5d6118cbf5ad0c2cc6be97882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084785, "uuid": "a6c57e7a-b86a-450f-b745-537ea661610f", "value": "T134049223B17CC5E6F89C3DF48A0997646AB46E920638F15BE90FBDD6E8B3223C1045D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084785, "uuid": "073ef133-d651-4f4d-9f31-0b1841c610d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084785, "uuid": "0a5a264b-a35b-4130-8327-a5028414cd24", "value": "384:44rLkJ/v4zzOT6m/O1JG15gHUKsMQmZjVBjN4IXQxxkSlSlSlSlSlKlfalfalfac:Vw2fXr2gH2m5vqGs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084785, "uuid": "13a6f722-2aef-4d20-9214-44c8ed645fda", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084785, "uuid": "3c9d3183-111b-49f8-861d-6438e20f54e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084785, "uuid": "a2dc5282-4f12-4da1-a99f-6e0db8f0f0af", "value": "MT0411694011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4997c95b-cf5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652076441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076441, "uuid": "8d080470-8592-4732-98f1-34bf41b3e323", "comment": "Malware payload (AgentTesla)", "value": "031c81f927be1bdf33cd913d04f177e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076441, "uuid": "ef0859dd-f3b6-4478-9df2-83c2a1c63024", "comment": "Malware payload (AgentTesla)", "value": "002ca5af13bbd9eb536df65ca6116638031e2c587fa84c179ac16631e3223b4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076441, "uuid": "0aadc7e0-277e-46fe-9b55-6da2a517c630", "comment": "Malware payload (AgentTesla)", "value": "1a6e13b2b7885fbc7d4c91611b38980daa785b75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076441, "uuid": "249bcb3c-0ba7-4a76-b193-2f9bbe679454", "comment": "Malware payload (AgentTesla)", "value": "e14502dab26012ea04124a126727278486f3d6a54d4c2820deb2b14186cdd580127d9309cfc6cb86222d7b28d132cf39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076441, "uuid": "789e2676-bafe-45d9-9b88-00efdc131183", "value": "T1BF049223B57CC5E6F89C3DF48A0997646AB42E920239F15BD94FBDC6E8B3223C2045D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076441, "uuid": "97527663-2536-4129-8f9e-b682f9956304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076441, "uuid": "f79d3bcf-4efa-49b5-9753-bbde5973ac99", "value": "384:2ufk+84mMcmco1uokU6UKsMQmZjVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalf3:z8Bw2U62m5vqGsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076441, "uuid": "51323662-52d7-4660-8629-14e440a5dae8", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076441, "uuid": "e99ade9c-1b57-4db1-8fb2-5a9bbb98f50a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076441, "uuid": "d0fee1d0-b804-470a-8829-a14278c750f6", "value": "MT605798102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814ffc32-cf9c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652103163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103163, "uuid": "b2415ae3-a4f2-4789-8389-6164078be329", "comment": "Malware payload (Formbook)", "value": "03c043c6cbb83ae8d1dece549763479a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103163, "uuid": "7e6d350f-a317-4a73-b42c-7154bcc9aa11", "comment": "Malware payload (Formbook)", "value": "002ea0849da3c63ce6c09c084567e9470c3616084ef19402316e9d52f35c62a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103163, "uuid": "a41e0485-69d9-454e-b7ee-42ea5759ab29", "comment": "Malware payload (Formbook)", "value": "6e6049cb6108aff6ae06f3204b07cda5842cf57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103163, "uuid": "380c7b81-5d31-41f5-aa7c-4b5213b93982", "comment": "Malware payload (Formbook)", "value": "4a6d2e29220ec319b7d0b2e7375a186685beeabb7e9bbb816641e06ce7246d62e9cc1365c94a7c6965af18fa8082437c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103163, "uuid": "6c8fdb11-ea9f-421f-a2bc-dbe4707d5bf6", "value": "T13DF4E00BAFFA03E7CE654FF1723152B407B62B2A7531E2852DC126F934627574A43A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103163, "uuid": "ec6e26e0-ded0-42fc-bab4-63acefc55442", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103163, "uuid": "080388d6-18cf-42ae-a065-a65a305b78f1", "value": "12288:krM2L2IgMK7pClE87X8koreLGyrqXn6siPLqlmvJY34qMrAwV:92U1OokoyLGyrqXQDJYIdr1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652103163, "uuid": "64d03cce-4b4e-41bc-9271-3c8ff8465e94", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652103163, "uuid": "abe007e1-fe1c-4333-a69e-4c2b69245307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103163, "uuid": "2dc3a77d-e1dd-4448-bf73-70eb0f78d03b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.11876.18957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326dfdcd-cf5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652076402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076402, "uuid": "0fa489c6-09e4-401a-8532-9f271da9cbb1", "comment": "Malware payload (AgentTesla)", "value": "eac1d4e33d3a0f682fa94a2042712199", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076402, "uuid": "f4c07b08-6fdc-4a9d-a46d-4913f93837b5", "comment": "Malware payload (AgentTesla)", "value": "00cd5b457e40df70be3728d185673a47b5ee02c0c08b30db34b5f1b9ec3a0290", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076402, "uuid": "b4652e5c-0fc2-40c7-9600-d3c71a28c26a", "comment": "Malware payload (AgentTesla)", "value": "2c14fe673eb6e3a20e89f8933389a11b0d89d28f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076402, "uuid": "dd5da6f4-e429-415f-a7bd-e6387d99e975", "comment": "Malware payload (AgentTesla)", "value": "7320c9544697698258fcd58cba9be900e11ac283ba4b30548f2a8097bed24a2e0a99b4c95ab891e26741aa62037cd510", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076402, "uuid": "e3af4225-e2c3-476a-8d7b-4e310707a6de", "value": "T1F8D4AF851394F914DF3F3734BD64E21083F0A2CA99BB874B4CC9A5A57B327C5BB81692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076402, "uuid": "48d20b6b-ac4b-4d78-bcca-59afa551b2d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076402, "uuid": "6c8dc2a3-ba6e-4b8a-a40e-f6ec7ff6a8d2", "value": "12288:C1fjz4ZagOG7MRRCgWbNmY+0tO9STF5rXTN:mfjz4wgOG7fgWZ+0U4TF5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076402, "uuid": "b3721ffc-cc10-40b7-a152-5c492d41bf64", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076402, "uuid": "83f14652-092b-463f-aa46-06715727302c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076402, "uuid": "ff9641f5-7e62-4938-9b6b-0107073a9314", "value": "DATA SHEET.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4710f9-cf9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104231, "uuid": "0485cee0-13da-43ff-b019-c688e48b177b", "comment": "Malware payload (SnakeKeylogger)", "value": "a7694fca506047fc66f2b8596302f5eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104231, "uuid": "057fc621-25aa-48e2-9a87-4443bca0a45a", "comment": "Malware payload (SnakeKeylogger)", "value": "03d18c169ad12b2e697d6c8ecd2c365b01fb3086e66c3321aba5c73f4c17e8f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104231, "uuid": "ce1b8f81-d010-49fd-a665-f14733746ee5", "comment": "Malware payload (SnakeKeylogger)", "value": "460699fe9a2ac12666c9ba2bf426b364fdb07447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104231, "uuid": "af480700-8fc2-4f63-8eff-d2317c1816c3", "comment": "Malware payload (SnakeKeylogger)", "value": "f00c5c6c78436e5318749f126c29d89868f31062f136b8e316f04a7ed38ddc5e555582448294246348aedc8766f7ab94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104231, "uuid": "5b623a63-8525-430d-8801-33bd6b2820dd", "value": "T1C3751224B6BD2BB3E5BE93F58466110003B6117E662FE3948EC231DF98E6F110966F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104231, "uuid": "5f337f6d-133f-41da-97fd-c82931270abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104231, "uuid": "47f704eb-dc98-429c-b382-fc1011414e24", "value": "24576:cFXNLjBml5zNhLTGK6K5B8sF40QlcmopLLuTRoo15uNDF1fVCZH1wSdLt5Hl1YV:OdLVg9X8s6l/op2zGNDfcZH1wKL/Hli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104231, "uuid": "e3e684e8-456a-4da9-a08c-16e6d92840bf", "value": 1664512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104231, "uuid": "bfea39da-1d2d-4629-9e6e-712bc8001324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104231, "uuid": "7e91bafa-500d-45a4-afc4-4d3f20de74b8", "value": "a7694fca506047fc66f2b8596302f5eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e370f1-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652104810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104810, "uuid": "35153c63-7ee9-4edc-9658-7050ae379d0e", "comment": "Malware payload (Mirai)", "value": "e6ac383c34517a9f62e0fe06c7a154ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104810, "uuid": "180ec16e-f46e-48bd-a22c-98282df37012", "comment": "Malware payload (Mirai)", "value": "046ffb8c8da9f12f9d2391f5251bd38cbd48791b82db36a2f81f1198588ec2ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104810, "uuid": "d7701c3b-081a-4a06-949c-1a2d5daa5826", "comment": "Malware payload (Mirai)", "value": "df42abd1e61d555f10f05ef45e8a62638ece2ec6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104810, "uuid": "cd0857bb-285d-47ac-b278-0cc73881f61c", "comment": "Malware payload (Mirai)", "value": "53a38778c9501a792b9d8a79c3007a6b68b5899218adbd2d170ae0fcf79a14518ccd6c55fa847d9469eed6919a86165d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104810, "uuid": "68f00e62-ef40-4b6d-8740-c268a37891b1", "value": "T18123F155560A4B71CA32AC72EC9E1786F37D5D6CF1CEB4076088A20873BB2ADCB59C47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104810, "uuid": "f7ec0490-a7c0-41bd-8b19-46742f72b314", "value": "768:c5lpPa7wNgUTbj3mMrxxjbSRGIAisFapQfMovLrtknm+9q3UELUyTQPvfaYvDIqA:cJPa7+THHxxyRGXz8L2rEmjLzQPvDvKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104810, "uuid": "2f646578-0299-4784-8261-16c5394b8cef", "value": 48996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104810, "uuid": "da0cde84-db74-46a8-b13a-7c2908b00fee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104810, "uuid": "b25a58f5-35e8-4e61-b5ac-05afc8f42446", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f22b2a1-cfe1-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652132794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132794, "uuid": "a3fb4f15-fe53-4006-b668-a0687df03187", "comment": "Malware payload (njrat)", "value": "21cdb2da55e477d79ccdf6f04f3e1c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132794, "uuid": "73df231a-a386-4f65-8d22-daace1f0bda1", "comment": "Malware payload (njrat)", "value": "04ccd42d32e481b2a06d8f23132586dd78581287de9a197e1193b89ed3fc6f75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132794, "uuid": "9155708c-1b91-49ed-b38b-397fad2e12e3", "comment": "Malware payload (njrat)", "value": "fa9bacfe5e45c2d22da7f7975b213326cd23ca7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132794, "uuid": "6a662976-a4dc-4320-ba44-6ab5872c403c", "comment": "Malware payload (njrat)", "value": "828a3b8b33fd7df189175e142c63e386f9daf5dfd8755a35ab135f80498fd11c941965ae7b31f559b69d0bbff9ac2473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132794, "uuid": "29b4d70b-6ce6-4f27-bffc-c26aa5e15160", "value": "T191A20A4E3FB88865C5BD1774CAB55A200371E1470422EE2A8CC564DBAF73BD62D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132794, "uuid": "ec85f870-65a1-4469-a96f-83360b914367", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132794, "uuid": "94cc5d2c-656c-4d5d-a10e-25d9c0a2d330", "value": "384:iQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZvd:9LL6MVU0NRpcnuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652132794, "uuid": "2273224e-7a03-4744-b136-c8ae933b7902", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652132794, "uuid": "4664001d-2ced-4a5d-b55b-0a3314cd609d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132794, "uuid": "f2f41095-63ca-410f-b36a-3bf85cc658da", "value": "21cdb2da55e477d79ccdf6f04f3e1c9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6700bf82-cfbc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652116863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116863, "uuid": "9af7ec0b-9743-425b-bdc1-55bdebbef2a4", "comment": "Malware payload", "value": "499e81780a5ef8a8f3e70ca1c5d64597", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116863, "uuid": "87265f20-488d-4839-b575-c0c271b85e2a", "comment": "Malware payload", "value": "04e09a2d4b77ece6e0e178d5cf8d1665048b834f481c66a3960d82d0eef51fea", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116863, "uuid": "bfb0385e-c70e-4dd0-b450-60b27da31b99", "comment": "Malware payload", "value": "70ee464dfbb9d0c8b3598aa5ccfc8f9866bb6361", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116863, "uuid": "cca1f65d-3f31-43f1-bcb4-024cc7c3441a", "comment": "Malware payload", "value": "b98c486b18967bf7a4fccfe17bafdf07f3dc0616f7d90005bfa75aba616d8ed807d8e20386c293a6d84a7d73c9bbcc30", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116863, "uuid": "d2501115-4e6a-4bc1-858c-8c8c244d7ec6", "value": "T1CC65E1BDC2D622D1C0289ADC2EE01C8EA790ECE736E587A1D54DD87DF522775338942B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116863, "uuid": "731b10fb-691e-41cf-a355-d8139012238c", "value": "6144:RZBiTCxc0HMXM7Get92GoiB2H0GVn5epAIGMoXRTregXHTgbZCFFO:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652116863, "uuid": "c3216613-3791-4a2f-a97d-35a62c6bff88", "value": 1452625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652116863, "uuid": "f9a7a7ac-ce67-41d8-b25c-87cfc1795d4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116863, "uuid": "fb8cd881-e8f1-4212-979f-93f73ab11dd3", "value": "Encrypted Client OG.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c73abf-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104246, "uuid": "06314e13-5f72-4923-9b5e-45c6c3192f02", "comment": "Malware payload (SnakeKeylogger)", "value": "90359cc855583e7f0ac83f234dc8f2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104246, "uuid": "7a12a15f-a1ec-4ef3-83ad-95f485a3b863", "comment": "Malware payload (SnakeKeylogger)", "value": "052bfb6090a6777453cc512827802e61a301fc2151d3af681cf30ac080b9f3da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104246, "uuid": "715353a9-3262-463c-b48e-212e5f8c68d7", "comment": "Malware payload (SnakeKeylogger)", "value": "5db87615eb2f79498aa7d2b583b1d0aa9eece08e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104246, "uuid": "1e3b9f34-cd97-45d7-b4fb-b12faee397ec", "comment": "Malware payload (SnakeKeylogger)", "value": "c2d4aa1bba67d77a57b79e228c379d069880871e6cc2f1263290e6b5dd62a38d6033f96b21f32ae05b70cb66eb9de3ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104246, "uuid": "1fdc98de-4b5c-49ce-8959-b272ce1b2835", "value": "T11044F1207ADCAFB3CAAE57B00C78B90113675A7B4709E7D44EC1AA8760C171988B5FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104246, "uuid": "abefe17d-9bbe-4fac-86c1-c8f1c562eba7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104246, "uuid": "0fa71fdb-c0db-46ae-87fb-9c774e84075b", "value": "6144:iY9lSSxmJpys8JWfZvB/4U9JR7zpy4zUp3gSg22MNqICYy/wzWp:iqSSSos46vB/4glI6sq2vqICYbzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104246, "uuid": "d072f474-be43-400f-8302-ff6cb615f185", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104246, "uuid": "e7713cb2-0b08-4590-a343-72683ef61fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104246, "uuid": "26c3592e-9ffd-4130-82ac-8b0bc315486f", "value": "409876545098765434567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43fddbd-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652084780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084780, "uuid": "4f4d7604-bff0-4b81-af90-1114b9778175", "comment": "Malware payload (Loki)", "value": "a14983a54edcf3b5f44ee9379fa99a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084780, "uuid": "f5b87d91-c839-4b4a-bd69-48aec6303469", "comment": "Malware payload (Loki)", "value": "06b56f10b333bff8cd37030b320ce796a86620d295dde9352eb98ab0f3f135ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084780, "uuid": "7a269072-ce2d-4cac-a0cc-9492b4241158", "comment": "Malware payload (Loki)", "value": "2c20bbdc5d91026b5d4715fe3e9098fce55703f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084780, "uuid": "476c02b6-2610-49a2-b8d5-c54f5237213d", "comment": "Malware payload (Loki)", "value": "81d5dfcee9a42c150cdde891e197d1e069c561b935c4647ad1bd0fc8d853754f4717dc137b20aeb07e5164bfd2756ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084780, "uuid": "e8d61c5a-e2d7-4f5b-8779-eb2ded2c5574", "value": "T18B556C447D5A8D90C19AF735F3AD21A50BB5A6834BE1F98D653836FC4883303AC1B79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084780, "uuid": "94cbeb41-ee50-4b07-bcab-1a25a39c56a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084780, "uuid": "4f502a41-994e-4a65-a65e-90e4d3268482", "value": "24576:E76PF0bfPZmlbsDWYtZ+z8PTLv1Qfqqd3FPKjJWdvQxG8kTnUyqwoJ3XNduNT0zD:OfPzZsLfqqpFPKjJWdvQxG8kTnUyqwo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084780, "uuid": "545735ab-840f-4da8-bac1-ca64db15fabf", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084780, "uuid": "d1e2e2a5-8f3f-4150-909d-8b06726c0e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084780, "uuid": "7ee5983b-39cf-406a-9287-43c7be0b1cd4", "value": "datos bancarios y facturas.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e46f3c-cfe3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652133635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133635, "uuid": "efefae29-3f68-48d1-b7a2-28b05e2f46db", "comment": "Malware payload", "value": "a4b7c421d773fad72b171e5a2fff32b0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133635, "uuid": "7af2fc30-5442-4b61-a0ce-89a3948e170e", "comment": "Malware payload", "value": "06e29cf356e429b6c42ec4fcd8e63ea726d2bf2ca839750ee5dc0389b05f9e76", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133635, "uuid": "b55b5af3-194d-4a94-ac26-fde7bed6b8cf", "comment": "Malware payload", "value": "819eaecd68b881bf0712891fbb2daa4650117f3d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133635, "uuid": "0db36acf-fd9b-42cb-bbfb-d5e06e71a017", "comment": "Malware payload", "value": "f8f22db94e56270f18b32dc08fbeb543c44c70813f4d52c48b1b10b388966224bd0636735b4bbfb5856b533759de40b8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133635, "uuid": "d123730b-2935-499e-a68a-cdfabbdd4399", "value": "T1506523AEBFA88568D1C216390B70BF63E5C06395FEA2D8F5130B0B89153508FF9857B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133635, "uuid": "4d515d88-4065-4d3a-b838-8db47177b87e", "value": "24576:5lpIvkK0DvLTL4kvDR8lpIvkK0DvLTL4kvDRmlpIvkK0DvLTL4kvDR3lpIvkK0Dx:PpIYtupIYtApIYt1pIYt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652133635, "uuid": "9c666391-d3f6-4582-992a-a7c8591d72a7", "value": 1416948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652133635, "uuid": "0c28b329-1451-4907-b29c-d3d37cbc4641", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133635, "uuid": "758d1b73-3de6-4273-814e-dbf4e4f85b6f", "value": "e-zrail519.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c21b3e8-cf7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652089679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089679, "uuid": "db170349-fbd0-4bf4-b592-e3b54503fd4a", "comment": "Malware payload (Mirai)", "value": "36fa0eebddc09558b084c03454662103", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089679, "uuid": "dbdd6ffa-486b-418f-a068-9784f6bda423", "comment": "Malware payload (Mirai)", "value": "06f39f38de82c79e4f72f96be35ba66d5f8c71233424948c1a22f1fe6a860002", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089679, "uuid": "b14938bd-7a06-484d-9c95-2d1e543f2a4e", "comment": "Malware payload (Mirai)", "value": "7056691ed054cef3a96f69dd9a410ecbc7b33734", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089679, "uuid": "4526acf9-eecb-486f-99f2-0a6f4d82dc9d", "comment": "Malware payload (Mirai)", "value": "b19f8e02b9860bef004b179546fb28dcf2c3c67a081fb39a8316c099cefce01742d3c3716a793aa4d83dc21a4cd5aeae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089679, "uuid": "45540b91-997f-4cea-a3d6-b184b18beab2", "value": "T131131B8D58012E2CDDE65DFD54636B5ADE616201A0E7060FD3AEFD832C3327DAF06598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089679, "uuid": "56efcc35-2894-4772-ab31-5c93450c8ce9", "value": "768:IpPtHthviqD25TeVhJWlN4je0UVKotrfKsFg89CmJGlN:IpBPvxD2Fg4ko7FgNmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089679, "uuid": "8e0aebe9-36d3-459d-82ba-be9ee29aca16", "value": 45452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089679, "uuid": "a2cab5b8-f551-4271-98c7-f228d2ea9785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089679, "uuid": "3622600f-1829-4f28-bfb6-043a86b84048", "value": "36fa0eebddc09558b084c03454662103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9afd4f-cf5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652076182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076182, "uuid": "4483de01-5261-47a2-9a7d-96f05210e4d5", "comment": "Malware payload (Mirai)", "value": "0a0f04d160126535d5ff525d7b527d5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076182, "uuid": "223daa2d-8aaa-4511-a38a-805330b0e640", "comment": "Malware payload (Mirai)", "value": "071a66a2da9378141b62631da5f0e8946c069f837176a2ee491cd095f45ca53e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076182, "uuid": "9fef8547-38e0-4907-821c-55a669e5a10b", "comment": "Malware payload (Mirai)", "value": "767c3312db6a91fb47a5bf8bc08cbc1366e438e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076182, "uuid": "3c105b1d-563a-433f-9bf8-6f468136e21f", "comment": "Malware payload (Mirai)", "value": "f0bf03614b027415fa3e2a4a10949b684368935fe9f338db44511f3e85a15dec17dcc35fab0912493af117a0f8a4fe4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076182, "uuid": "ae4f914c-a0c6-4462-b90b-5f0e6c041f71", "value": "T1B063964D3E319FACFBA8463457F39E10A35823D526E1CA85E29CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076182, "uuid": "d2673dfc-2894-4674-bcb6-1f54a532cdec", "value": "768:RzZWyvL5MsRXxPx2pqV2UBz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UrGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076182, "uuid": "d404edb0-45d1-4794-8e23-84c8ac464371", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076182, "uuid": "1c7e90f8-ef1b-4bb7-a299-5a5acbba4f00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076182, "uuid": "7f1c20b8-bb7b-48b3-8eaf-cf934efbe57d", "value": "0a0f04d160126535d5ff525d7b527d5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56309b28-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652104808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104808, "uuid": "518c8c54-1101-407e-a82e-0d640f6dd142", "comment": "Malware payload (Mirai)", "value": "775e0a2207ffbad0e574cd5b307d97e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104808, "uuid": "d347a5ef-9efb-4485-bcdf-29ca7ad60198", "comment": "Malware payload (Mirai)", "value": "0734743a64009e12bf41745cecfe411a07d8ebd4733e3ad34e0cecfc95ddbe47", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104808, "uuid": "59c37479-ef80-4d95-865b-2fdab235657c", "comment": "Malware payload (Mirai)", "value": "10b4580f1fdd7934e0c131552aac326e60e74960", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104808, "uuid": "5740081b-8f21-4466-8bda-e4b89d0271e9", "comment": "Malware payload (Mirai)", "value": "879f60cc16489bfa37b588d38ac8b54a139fc623ac2ae7d459c116108239760d04b32cc3482167033a0d52d4d412c9dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104808, "uuid": "0230f673-57bf-4c1f-8cdd-f6adb0fa7b3a", "value": "T125B2D04FA7E74E17C092027A677F467DAC3A3CE64DAAA74239A7D340C3069471D32C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104808, "uuid": "b9a347b3-7903-4adc-b3ae-6084a13ef4b3", "value": "384:MGT44eyTGkYNxGdfVlHz4PiLvG27Xz8TR1Lti2OYuOeb1IdFqiQNLv1Rl:Rc4VTqxufVlTbLOEYTvLt7uBmdYL9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104808, "uuid": "5f4a9183-d6e6-47a3-83b6-eabc2587e0ed", "value": 24748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104808, "uuid": "32232c40-0010-44a9-922a-41cef0ebc6d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104808, "uuid": "fe9b01f9-2a6a-4553-8147-7220acd1d357", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8854cffb-cf85-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652093296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093296, "uuid": "2dbca92d-0ad9-476e-8fa6-86fc3149e7e1", "comment": "Malware payload (AgentTesla)", "value": "20d2087d90151011632d91cbc97fc46f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093296, "uuid": "84d2f6f6-abea-4fa4-94e9-6aea44f8f025", "comment": "Malware payload (AgentTesla)", "value": "078063639a561c74ec81c3c486747b164c483485b7d7f304f5cbf716baf6ff8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093296, "uuid": "891bfa7b-7a6a-4899-ad2e-3cf0d8deceed", "comment": "Malware payload (AgentTesla)", "value": "e157af3e658b2aa97f863165c75a06dc7e15d500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093296, "uuid": "4e91ba4b-fe9f-461f-bfbc-3ced94949415", "comment": "Malware payload (AgentTesla)", "value": "5de110aabbb313fe85f9ed20532207991a58c7ac1f15965587830cba3906d28f8ffbb441881b7ad272c0dccc01421992", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093296, "uuid": "83bb6a09-e0cc-4557-81cf-cf629440af89", "value": "T1DDF4E1081A570625C1EA5FFA685211308FEA9FDC3859FF528C047AE67772BC46BC3A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093296, "uuid": "44d36a98-7f29-4816-ab63-02f662bc31fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093296, "uuid": "d856bf6f-56b1-42d7-97cd-78e88abc86c0", "value": "12288:dQb2L2IWVmbsYxnXWRi49R6juNFPWH5YdCblPgFudJg/8tZouqFp6nt:82gVmbsYxnGgjuNFPWHYCbIubmoaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652093296, "uuid": "6fcdb0e9-0531-4158-9d45-fa1519e8c143", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652093296, "uuid": "25153d63-3f11-4c8a-a73e-c4c60fd37499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093296, "uuid": "faa0dd00-c908-4659-9d09-e717bb46e574", "value": "SecuriteInfo.com.Variant.Bulz.779298.17068.16607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ade299-cfe5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652134515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134515, "uuid": "17902017-0a2d-4991-b249-2fe3c4c23b4b", "comment": "Malware payload", "value": "a6ee357c4d935820e3b6803080773b70", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134515, "uuid": "08075268-472d-4657-835d-1558e72f9762", "comment": "Malware payload", "value": "07857cc1cc07e17b7b5782ae5ccf5e34e6ad4b75b28da344c529f5e2d2c89c8d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134515, "uuid": "fb83f5e7-abde-4dfe-b04c-acd500c6fbd2", "comment": "Malware payload", "value": "19f3b4ca58bc5e1c6170345de148840f2f80b6a1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134515, "uuid": "2f250e3e-cae8-4964-82f4-65afdcd99244", "comment": "Malware payload", "value": "b86f60e22570a7d43d4add62d15cdba206dece854b91fc8b47f7a73d36c1146a6b04740366c28c199baf48d71ceffb4d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134515, "uuid": "d7bf60d3-2929-458b-8486-49f91eaa446a", "value": "T163F612E2FBA9EC1ED0B3E172867E027368A58E946A41D7161509F21C7FF3A814B44FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134515, "uuid": "0da84a97-f826-44f2-9a76-d7424e54b12e", "value": "393216:mzI5SLoMfSZ+gYdyRKyWyghqlpAGz7JcelI:mzzS0gYUAyWy6GzZlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652134515, "uuid": "03df710c-4374-4268-a875-cba9ac36aa56", "value": 16409703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652134515, "uuid": "e93da8df-6988-43ca-9aa8-95ad3ad63c9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134515, "uuid": "7de2c828-b488-421e-8714-2ee236071633", "value": "ezrail959.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7663f58-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652104623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104623, "uuid": "840122f3-2730-43df-b60a-e621155e5c0b", "comment": "Malware payload", "value": "392463424afec10b728e4c15894a3174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104623, "uuid": "d59d4560-a57f-497e-8610-24b4e09172e1", "comment": "Malware payload", "value": "07b003c567ae8a3d53ad5a4977b20c4f6104feeceabde359de254d99fa5b7a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104623, "uuid": "d54b74c0-23e1-4c91-a3ad-81f6cb717cef", "comment": "Malware payload", "value": "188b6139781d0971915c6424fecf5e9c671388b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104623, "uuid": "9c7e6120-6eb5-426a-9be9-c467af5bebef", "comment": "Malware payload", "value": "147650499db1b7e4cbd0defb97cb426a0c83556d7d434de24e99d2f06e9a91d8c819cf95ea817435823ae47e0d3c9451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104623, "uuid": "f5097605-1e4a-4259-8c1b-1e273e926ddd", "value": "T1E8757F11A7A6DCABE2E26C314D675F8C9928ED06CD76023B13A7771E2FB13C81D5E604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104623, "uuid": "f613202d-3bf0-412d-9f7e-ac8ec6aef9b4", "value": "beabf9b50565930c7fbbd010019f7484", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104623, "uuid": "a4619562-3b85-4fff-988b-c8398ba6f32e", "value": "24576:+NEe5z96CLcVUnAyMWOmIIzkG5P5mG5DzgmI6vXJ:+NEeV96gHAyXOmIM5TgXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104623, "uuid": "3daa46e9-c170-4a8e-99c9-068553093d9d", "value": 1558720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104623, "uuid": "31381243-6816-4fce-acc2-b4c06e947c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104623, "uuid": "78eed5a0-93b4-4e1c-b070-fc8d30af8ad2", "value": "392463424afec10b728e4c15894a3174.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ffd1f2-cf8a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652095599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095599, "uuid": "dcebf1ba-5e7a-4f69-b1e3-ecf1886b2b22", "comment": "Malware payload (AgentTesla)", "value": "a296a8b2aead2899b3dba5fd11788191", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095599, "uuid": "265cb13d-1874-481e-8d96-9943de747a13", "comment": "Malware payload (AgentTesla)", "value": "0878ee8d6423e90577609eb755f409437eb87a3690d88dcaacf7a45a7913a25b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095599, "uuid": "f68ab213-a608-4151-8f2f-a2d805d78f04", "comment": "Malware payload (AgentTesla)", "value": "f248ab97351368bb88a7ac8834915018ca2be959", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095599, "uuid": "bc0eedce-43c9-4de0-a115-5514f66db20c", "comment": "Malware payload (AgentTesla)", "value": "064420aceb33d1cbed6683272b649bfbb087f251e829fcdedd214495f0b04785922fa444adb1339f9ad63a850ce325d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095599, "uuid": "9f37bc54-0452-4727-aa24-a6c3bde902b4", "value": "T10FE42309B6E31777C735A3F072D682A493F2265CB5A2F39D0DD022DE26A37564B01E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095599, "uuid": "369e28fd-6371-4684-b386-d97cc0956810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095599, "uuid": "08d032cf-3e58-48b8-ab81-dfa0a976756a", "value": "12288:fmb2L2IrWMEBArhxIiVPF5EFJwPbXp7XuD3szs8Xl:s2pPEBArhxIiVviUb5es/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095599, "uuid": "9eb49d05-0047-4874-b70b-284e35ab4d66", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095599, "uuid": "e3f0798c-7941-464e-8cd3-7abb501b0be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095599, "uuid": "a27c3700-67ee-4cca-ad9a-65644a1e77dc", "value": "SWIFT09.05.2022 ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd17ff9-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652084793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084793, "uuid": "7d0ac1ca-19c6-4a85-a083-23e298f7f64f", "comment": "Malware payload", "value": "285265f674fa3a372a696d57583d78e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084793, "uuid": "358a397d-e0ba-421e-8774-5bdf5894c95a", "comment": "Malware payload", "value": "091287d4c138064a9ffba4c63d616ae4d30af380960411afc561754e112be9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084793, "uuid": "c76caa05-1b78-4bef-bf5b-f99b5f06ddc4", "comment": "Malware payload", "value": "48db0a229ec6df88c4c960f6dc375e509f66fce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084793, "uuid": "501a8417-37e0-4008-9550-be5863e5a0e6", "comment": "Malware payload", "value": "1ccffaecc74afe325b4be19be33d4699d2b65a05687c174f43e843fdea6b25896de44ef8bc87151c11a15cec3a5179d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084793, "uuid": "324339cd-5e66-452b-94ac-c3a4a6060a67", "value": "T1E703E71A7892961DC5D47BF869B1A19762367CE10124C14FECF9BF2AAD73223CCC216D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084793, "uuid": "2c9d6528-1fb8-40d8-94a2-2cc2ffbaf6e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084793, "uuid": "1d65b662-ce3a-4fbe-a331-6a486c5d9576", "value": "384:wjxyIblPCCCaMQ6ulaiJMwCKTH2S3dd0hUADkadD:wjxytFml7MwCKt3deVDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084793, "uuid": "8dc3d4f8-4b9a-429c-89f5-d942124d1d03", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084793, "uuid": "cfe93661-10aa-4c76-9bec-23e0b2fcffdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084793, "uuid": "417c23fc-f84e-4477-912e-e063062150ef", "value": "PO#3102205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d807ea41-cfbd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117482, "uuid": "2f531dd5-41bf-4769-b984-bd0ae6472ba6", "comment": "Malware payload", "value": "fdb0bfbc244343c8614be097ae58ea74", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117482, "uuid": "f24ddaaa-d838-455e-aa69-207e693afded", "comment": "Malware payload", "value": "0935319f18514842a11d95bc435972a23b618ff294d2a861f2149954871c6784", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117482, "uuid": "3f985167-44c9-440c-9a7b-b4e5017f9ccb", "comment": "Malware payload", "value": "b6fe185c70a04b92fdb1e320f83a797e5d2718fd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117482, "uuid": "31e2dbdf-0979-4e1a-9d82-61404dc4d157", "comment": "Malware payload", "value": "5b7a968914b39b2691efdcd3187a9d584a8fa2b8c86a1328014c3c69d7fdecf2adf7cbd4a5722d786118d892797b933d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117482, "uuid": "4ec0e8a5-8d67-4803-b40a-5e060fe3fba6", "value": "T16585AE1D12C201F4AE6C4BD50F79B9E83C91B256F49C31B99378A9D29F241FC94893BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117482, "uuid": "ad5dd454-4233-4497-9e27-d7955e5f9996", "value": "6144:aOeCELHlEJnerg13v7Gu9BwBEJxMjFVqy82XwpayIr/7OlimateskdheP5/NdcPs:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117482, "uuid": "dcf51241-9d62-4664-a69a-c14729159b21", "value": 1824560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117482, "uuid": "0ea9fafd-c43f-49e9-91ba-c34363150e7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117482, "uuid": "04b5c489-71c9-44d7-8a10-00f2f6809245", "value": "Encrypted Client OG.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd3a1d7-cfaa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652109249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109249, "uuid": "3c48f1df-1fdc-417e-9b1f-a473a23fa4dd", "comment": "Malware payload", "value": "b3554f62058b0a9686b83a4bad39d95c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109249, "uuid": "fee1485b-99d3-4422-9ede-3d1c334f9f78", "comment": "Malware payload", "value": "098f0f7e67a09ae9e0400a5c6ccbbb578262a50cac70423ff236d753eecc69dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109249, "uuid": "28b1b727-8519-4617-ba2d-b6acc430955a", "comment": "Malware payload", "value": "ab42656acfcacd352e46d0e1b4a6a03aaebf6047", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109249, "uuid": "3e6dcf6c-2bfc-44c1-ac8b-cda58967f6ce", "comment": "Malware payload", "value": "438a98ae25764393e4d981cf07e5de7692daf399449ccb6a55b5e2b1f6bd621dee3cd57f1fea4b74c6105082775291c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109249, "uuid": "1a9c0df1-17e7-48d5-9dec-175bd5db2ce7", "value": "T1EC54B4D9F78D112E423231AAAC2E12CDB77CD171560458AEFD4D597C24A083D83BAF7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109249, "uuid": "ebf85fb8-6ef9-482f-9501-36235f89813e", "value": "6144:gJshNVl9+TCtllhTNeKplyYmD2zK8IoJEyPx+WK+978FyW48L/dCaYeNzIPf/vf4:xxlyYmD4BDPx+WK+978FyMhr+PffA+up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109249, "uuid": "b4da6d26-fbbf-45fd-b0ee-b32e8c145079", "value": 293106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109249, "uuid": "cad8e101-cee2-4bc7-90cf-3fdf13eeda35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109249, "uuid": "3452fb3d-acec-478e-9c0c-dbc7ab6ae4a0", "value": "bcnu_collective_agreement_special_leave 40956.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbf0438-cfa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652108497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108497, "uuid": "b2304d95-1d72-44d9-b629-0708b04b068f", "comment": "Malware payload (Loki)", "value": "f92f364910d05162ecd7294b6133a87d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108497, "uuid": "a05c5008-d0a4-4fac-94a0-fa08e9a91842", "comment": "Malware payload (Loki)", "value": "0a3c5deb5f9ac0edb417852cc74f8079bf14ccc9d79d301187a23abda7d18bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108497, "uuid": "bd175ac5-aaaf-45c5-9da8-4a7c2ac751e0", "comment": "Malware payload (Loki)", "value": "a0b5f9e5c211ec9f95c6c375a918524aad4b9542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108497, "uuid": "f7bee5f9-927e-4407-acd8-65fd7a998632", "comment": "Malware payload (Loki)", "value": "73938a17193e7472dd31a4f1ce132878ff8e7c3ba983271e9de500af8ab327352ebcad54dd07c6338b3af0f251df5b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108497, "uuid": "4efb86bf-7981-4d2b-b2d3-d116c62fdd6c", "value": "T158E4CFAC72507AEFC857CD76CA941C64AA61747B530BE243A42316EC9E4DA9BCF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108497, "uuid": "3b67e9d6-a0db-4e66-aaf5-02c3958cd558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108497, "uuid": "32b2c39f-8dc8-4af7-b27e-a5b045445e25", "value": "12288:Lz+ZX2L2IHiL42GrEUvw7aIlwHJHstJpCryyHXTvxb7BaX/6IqI+QM2:M2+BGrEUvkaIlcqp253T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652108497, "uuid": "ecd10ea9-2aba-4a21-9f66-c770e8983be5", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652108497, "uuid": "6b203abb-2913-4710-a71f-14440453a736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108497, "uuid": "da0cf56c-f165-4eea-a4ee-8e1f1aae10be", "value": "DEVOLUCI\u00d3N DE PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7779f688-cfc0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652118608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "b66684a8-ef3b-4617-af64-6adacb433b38", "comment": "Malware payload", "value": "7c21967018a6af6f2ad8d0eae439f148", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "ec540f69-bea6-4ad1-b3a2-18890908590b", "comment": "Malware payload", "value": "0a403244f9e8c9058b89ec14a461d8a3bba6205398b1a7986e0d911a68f90109", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "813ec9d5-9d37-42fd-a6f4-77be47f4831c", "comment": "Malware payload", "value": "0523f0a4a6aea5e1cc738d4af882bf6db626fd01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "f2f53361-5de0-45d5-81fd-0afcd9518554", "comment": "Malware payload", "value": "d2bf0dba4fc7b86a91f3047958408d514970244a1204d3cf468924f0585a18db2be8bedf3df88bcc7f3afb5d91542ff4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "595c34a9-f874-4c7d-8bec-78a53bcafd0e", "value": "T17363F882BC80EA26CBC01677FA5F508E331567D8E1EA32469D155FA076CFC1B0D5B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "4738fdcd-a2dd-4aa8-9e86-fb130a639a0c", "value": "1536:7Z4ZLO7YQ010oQJ6sZ4U7jL1B8t46eTmTJ2C:7Z4k7L0K7nn84JTsJ2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118608, "uuid": "2b2ddcab-e40d-4faf-a568-c5bf9b263d74", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118608, "uuid": "2076275c-e84f-4fd1-a34c-063994b6f4a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "ef92d0dd-a7ae-4e21-b610-3860f5729704", "value": "1isequal9.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3b2aa1-cfbd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117276, "uuid": "849f673e-03c1-41da-81ce-20d3a2b8f418", "comment": "Malware payload", "value": "f121071939d4f918e465bc4a5d990db0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117276, "uuid": "2ecd1103-280e-404b-9de6-3b536ca98dd2", "comment": "Malware payload", "value": "0a678fb9faabedfeb96cba05015bdbaa02830aada6d8dc3b73f8caf1c90502a2", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117276, "uuid": "753d5919-454b-4c0a-bbde-48ca97e629fa", "comment": "Malware payload", "value": "667bb0e07375cd07271152f50776fa0a54e42672", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117276, "uuid": "bad8c314-3495-4e8f-99e4-6d64ab73db17", "comment": "Malware payload", "value": "e64f20d07bc01438aaed83f9d973010e51934cc51c13946b9ef7e4c3bbda12175488aeefb807be150c82fa5ae9a9ecc7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117276, "uuid": "d1f955c2-73a8-4377-9abd-d5deeb569798", "value": "T13A85EC5E00EE5920A5642BE12B9D3BAE36E2B733FD8C1A645BB975C24F759CCC041336", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117276, "uuid": "8ea848fc-c449-4fc6-bfe7-5ad2cbbadfcc", "value": "3072:LNeu1MpvvK7nRB8lWI8jL512NZwKPZBdEs31pgpapwHACbual7FdC9Tc681jbidf:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117276, "uuid": "1106756b-3497-4de9-b76a-e5a605dc1375", "value": 1824350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117276, "uuid": "3ab38463-8d49-4892-bc25-58d03447ea4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117276, "uuid": "47c3b27e-8b17-4273-a644-9b8d0dde9289", "value": "Encrypted.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7790dbcf-cfc0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652118608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "cf6bd6a4-5bda-493f-85e0-a771c07655b9", "comment": "Malware payload (Mirai)", "value": "438f93de4e4d3c193a385a9adf9d4560", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "10480002-4f11-494b-9953-65b4e3c34ce2", "comment": "Malware payload (Mirai)", "value": "0a7d59d4b3013ec4f3d6601633ef92a98b01cf4cc77c29e1f7271a06786b76b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "4da51564-c0ab-4a3b-800d-43afd79d23d0", "comment": "Malware payload (Mirai)", "value": "4d11c5035e86691df8dc4c59647ae5cdb1965012", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "3baaeafa-fa84-42dd-b16c-5006322c7c6f", "comment": "Malware payload (Mirai)", "value": "4d87cdd4e70918a282a38d44ccc274a64aeae21acefc951e2cebc782f381ffab2ea280311f0a7b04b82d3a5c4d2997ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "0fa6a9b3-2e60-42b6-b22f-5c1308a27556", "value": "T13793651AAFA05EF7D8AFDC3346A91B4524CD5416258CBF79BD30D918F20A24F19E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "f21bd07d-261c-4fd4-a3d7-92eb8b9f1510", "value": "1536:2hG+9sUX9ZBLftw7TKp6/cGG6yBJkMFlRgl+o5ZS4Hi:iG+9sUX9fftW+p64C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118608, "uuid": "d785c98b-4401-412d-8ba7-6108974e418a", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118608, "uuid": "81492393-6ead-473d-8eb6-d8d266b42978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "578e5986-9b9e-4363-8b26-24205c1e513f", "value": "1isequal9.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80b8e5a-cfa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652106234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106234, "uuid": "9b4a0767-ba45-4c2c-a582-fe7ee536b99a", "comment": "Malware payload (Formbook)", "value": "6b77b1a2a79d82448e4dd25922c2e45a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106234, "uuid": "97a04a18-747d-4aad-8d83-3f5407577d75", "comment": "Malware payload (Formbook)", "value": "0b4ad9a30e1a3b938aa04ed4deff9c24074414d06afa217d92a20e18c4335d68", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106234, "uuid": "ce77dab4-2a30-402c-b9f7-f5e78438d1dc", "comment": "Malware payload (Formbook)", "value": "dbeaef8535b34ae8c914db1dd31b7e9ce24cd014", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106234, "uuid": "a2b0ff07-2907-4b70-8310-debb87501dce", "comment": "Malware payload (Formbook)", "value": "e0b913f0e085c93bd184627b3a9e46acea591a76c878c674ccadf6d3e2e8237f7bbbeb748dc57810369c51b75539c539", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106234, "uuid": "c03592d0-ec8c-4bb2-a942-e909a8c0c67b", "value": "T1E2C423FBEBA93C33BD654A0E423DC224DE0B8F020B998DF05958558232596D561F39EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106234, "uuid": "cd2ebfce-ae72-4628-ac2c-e46e18ec6a17", "value": "12288:PLdmM4lIqZcYjiZ4uAEV+j/SLQ4dyCACvwGSooKB/e4B4JX0A21:PLSWjf4uAR0wCIGS3Im1X0A21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106234, "uuid": "eda00b62-f57e-43c5-bb00-23f2aee8f8f5", "value": 568013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106234, "uuid": "417094bf-f801-4da9-8e39-4a477a3ac1df", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106234, "uuid": "ea69f5cd-2f15-421a-bf7d-e546dfaf2b2c", "value": "DHL EXPRESS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a005e9-cf54-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652072406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072406, "uuid": "56460577-e5eb-4f2c-819d-54689ac0a467", "comment": "Malware payload (Mirai)", "value": "8921f7322e0b9d56ccab7ab6ba3881e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072406, "uuid": "582d3e7d-d5dc-404d-a9a0-04d14ceadf93", "comment": "Malware payload (Mirai)", "value": "0b8603871290278ceda3c6599b0a07e518caec79085663d72f27e0e81dd01df7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072406, "uuid": "eb71d227-110e-47a4-a67f-f5add718e6ae", "comment": "Malware payload (Mirai)", "value": "e63ae34a2903f4ee818320409ace0cd51d034916", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072406, "uuid": "da697153-0ea8-42ae-b9c5-d87dcc70a61a", "comment": "Malware payload (Mirai)", "value": "802f08768748c68b91a30f20248881aa924b0d540423d7b7cf6b856ebca2519f6c186c2b76623294e73651183f281e6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072406, "uuid": "f08924af-b23b-40b4-a6be-67d90308a2e7", "value": "T19EE34C46EA808E03C4D61776BAAF424A33239754D3DB73068D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072406, "uuid": "012cdc28-9c3e-4b8e-848a-db60ad80df8f", "value": "3072:NRR6WjwnOKwaVDV2uiGUD/vzdMvEi3cxgM/9yD+Sf:/MSYnwaVDV2uZUDhQEi3ceM/9ySSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652072406, "uuid": "bf5ab169-13c8-4532-b3d7-060a8c6831c5", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652072406, "uuid": "5311438f-8e69-4fee-9ea2-151a60894cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072406, "uuid": "dfd40516-6f7c-41c8-b0f6-d106bd27de44", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c490b285-cf5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652077076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077076, "uuid": "8764c205-aaf5-48bb-a961-dee0a8109f1c", "comment": "Malware payload (AveMariaRAT)", "value": "f2357d143c6eba5a471d4b0e76293645", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077076, "uuid": "cf735c4d-8223-49be-a313-ecf7e4e9a5cf", "comment": "Malware payload (AveMariaRAT)", "value": "0c18432c31c376440da6d9adc25ebc4469231062a29f4ee110859a42f0c07106", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077076, "uuid": "90b57d94-8df7-4b76-bcd9-a55ac9042e72", "comment": "Malware payload (AveMariaRAT)", "value": "50927d7f5b0156d10650f1a1b8d30fd2e1dddb7f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077076, "uuid": "42360f78-840d-4183-bcca-6fdc55f69f47", "comment": "Malware payload (AveMariaRAT)", "value": "a755f9c19dde0adca353edea74209116d382292dfc52bd32fdf06dce53fc54d917fcfa21ebe0d8f1a9bea8d2784b548f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077076, "uuid": "c5372dad-23c4-4fca-8ce5-7f2ff7dd50fe", "value": "T1B3A4389CB12070DEF45BD4B2C9682C64A691766A431F42039433F3AE9E6D6F3CE55CB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077076, "uuid": "d9f93149-c1de-4402-9554-a3d831a08ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077076, "uuid": "a4f35d15-cb93-43fa-8c93-ced1f8f357ba", "value": "12288:RgjjSrYPDoDUODu6i1x2bu290kkvL21BloW28VEPgE8GNdA6m:RgjjKKsNq64x2bR90kq21Blo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077076, "uuid": "694b3684-0ca1-42d9-92ef-7d2f108dabc1", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077076, "uuid": "f936670b-011c-49c6-ba25-d193789cfe1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077076, "uuid": "f4311be3-c9f9-4430-942f-cf09d9b759b0", "value": "EPC of Sheikh Adi-4 Wellhead Facilities and Associated Gathering System.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fd32b7-cfa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652106144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106144, "uuid": "f57597f7-ac30-42ca-a861-63e356188130", "comment": "Malware payload (AgentTesla)", "value": "f062d3e863f6bdc828a474e43063c682", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106144, "uuid": "368e3467-4996-4e0a-81a5-b701c6fdf3d5", "comment": "Malware payload (AgentTesla)", "value": "0c754a43b8ce4c593050f7be9a6a9d81226291f99f12e19a05c3abcbeed01b30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106144, "uuid": "e05c3474-907c-4e61-87a5-d56092f32f16", "comment": "Malware payload (AgentTesla)", "value": "d3dd57fb331c7fbfeeeb3f83c0e5cbfcb64c4b8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106144, "uuid": "dd9190c0-f83d-4908-ba24-bd50ceed8f31", "comment": "Malware payload (AgentTesla)", "value": "367ef4a22232a0740d6fd4d4188a0b6c2a2554dba46d2fa328f893dba6eca95578cf03bcd9d0f419f8489b66e2c61d1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106144, "uuid": "79b08e7b-f72b-4ba0-8d72-a19fa5aa43b7", "value": "T14BC4120AFAEBC901D2B95A3BD5D4150003B11AE77613D71F2EC62256AA133CB9F46BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106144, "uuid": "3698cac0-d1de-4294-8c9b-10aba98ffe91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106144, "uuid": "b1e12f96-fdf6-4452-a2ed-9aa2b3e4cc35", "value": "12288:VAFVIRShzdce+zPn5ubK/r+j3cDISJGJIpjExizvLc6cvko:VAhdcPCK/r+j3cDI2GIxExib47L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106144, "uuid": "6a524b7b-9ef8-4cac-a7c7-12236bf59e8c", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106144, "uuid": "c8b20190-7cf6-4143-b687-395e0420fa5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106144, "uuid": "3b960a51-be72-4ef9-addb-7ce98e0071b1", "value": "Statement of account# 200122001100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6077474c-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652058440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058440, "uuid": "208230ae-612d-42e4-8601-582269730e8c", "comment": "Malware payload", "value": "4051e8fce21e045e7b03396a0d0ebdda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058440, "uuid": "01ede107-a4e0-41d1-8517-ebb544457920", "comment": "Malware payload", "value": "10063b509b905be15d3571a92bb0ae3d084eb95ee1635e5cd965d31b67c0ecf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058440, "uuid": "02752aaf-53a2-464d-b9a4-27dce5ae4c8c", "comment": "Malware payload", "value": "cb13c25206011197b2f416ce1726dfbefa176a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058440, "uuid": "618a4949-04d9-4ecc-90d7-3f888484ddc2", "comment": "Malware payload", "value": "5107bb69adfde9bf8697db5ecd7eab5d0a45160d4febd521e1ec6622ee3b52d28547b926f4f07b9ea30902e431216fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058440, "uuid": "aece1721-8b3a-492c-9467-3c1112e86db3", "value": "T188826C18B3D5C673D4BB8B3114E70B50AAB0F6649A37470ED4C6123FDE5331A0A6BB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058440, "uuid": "28e7ce40-5b64-4349-af27-eb8437c3c48f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058440, "uuid": "2644f7f9-1f2e-4990-a958-cee2a94b25fe", "value": "384:d8Xg6gmHe+EaNCOJASUaepk0OOyd3zhzY+U:SXTLAMChSUaq1LyJdzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058440, "uuid": "b1ea2fd6-8392-4e86-8b94-91c6fb5f697c", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058440, "uuid": "8b1ad5b5-d0a0-446d-a94c-5e146b64d79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058440, "uuid": "fe7eb267-ef7c-41d7-90a6-04ff2c95a3d1", "value": "lista de pedidos y productos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac576409-cf72-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652085196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085196, "uuid": "f1a123c6-a248-4dbf-b2f0-62142d290135", "comment": "Malware payload (Formbook)", "value": "70b2988809ebd6dfe9360d1860b47a1a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085196, "uuid": "2ea2a76d-7a20-41f5-960d-a05f8ea4cda5", "comment": "Malware payload (Formbook)", "value": "105a662b72268e78bcfa8454b5814126deb92e66034184faa45365a65f41486f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085196, "uuid": "0c5a9743-0795-4f61-aebe-cf9286e3c7f7", "comment": "Malware payload (Formbook)", "value": "1b5ac4e9d1f5f10da4d4f0c51bf1a7d89c568259", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085196, "uuid": "a343a393-a687-44cb-91fe-4464f8899526", "comment": "Malware payload (Formbook)", "value": "3f03f36e52dc99b197cfbe967ddb56568a07f26d0c8739a4d6ca94c8edebc87739f942ee535dde6e8bc7a0e0ded45af2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085196, "uuid": "978a334d-2121-4e11-8c4c-2bc8f5efcca6", "value": "T11E75FB31B132BA87C3160561565FBE86531CBE43B2C55F8CA04DFBF82CE6CA69342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085196, "uuid": "2084c425-bac9-4081-82bf-6485a3591b00", "value": "1536:+ch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5b1:Oz0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652085196, "uuid": "531b6f6c-477b-4639-9896-2ec575638320", "value": 1677895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652085196, "uuid": "1f2b6ab0-ea22-464e-bb60-c2217b2b4d21", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085196, "uuid": "db52d14b-8bf8-4e71-a648-cce805cfd930", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.104.19540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1778eead-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130903, "uuid": "02e54d68-162a-4449-8d30-6553b07467d1", "comment": "Malware payload (Mirai)", "value": "58f93c59a325c80758b039b57d62d3b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130903, "uuid": "d8f2188f-8ddf-4d75-bd1c-555573adfd25", "comment": "Malware payload (Mirai)", "value": "112303230bb226e677f08cc29095c2d142e2c7ddd060b956f10ea0236de1a79d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130903, "uuid": "ce6bcd93-ca64-4164-a401-1b85500ead2a", "comment": "Malware payload (Mirai)", "value": "954fdfef8ef2a2b36b8a89a218f1e7b662d30e2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130903, "uuid": "99d19d22-7d6b-4ff6-ab38-9a063e481b9b", "comment": "Malware payload (Mirai)", "value": "144c16c8d16cb08ae9bea36d584596270a88e0ccc9e4ce31223d9ba9adae4799bbd19cd52aa0bed62285e7765630e830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130903, "uuid": "450f0860-026f-4789-80dc-7c2452e5c0b8", "value": "T138339319BF610FB7DCAFDC3349A9175124CCA52A25A93B36BD30D418F24B64F16E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130903, "uuid": "69fbb8f0-80e4-4848-b4a8-8ef0645dec11", "value": "768:RXgdsbbKJ7hAM2tXihWSIns0Rsoepevne8ysmcvZDdpXizkMQO:RXgds3KJu0WSIPxImnv5tvZDdCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130903, "uuid": "35171ad0-1658-441f-ae6c-f1ca899d22be", "value": 52712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130903, "uuid": "672610f5-cd00-4b8c-9b14-aaac83065e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130903, "uuid": "1e1b575f-88ee-4800-b5ba-ae7004965d16", "value": "58f93c59a325c80758b039b57d62d3b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e3f9fd-cf70-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1652084170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084170, "uuid": "da5d0737-8375-41c6-9052-b049fcdf5c34", "comment": "Malware payload (OskiStealer)", "value": "980068c5d5da628dd5af8a2a21250ea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084170, "uuid": "09ddc144-2f58-47d2-81eb-b9b3a670f70b", "comment": "Malware payload (OskiStealer)", "value": "11810610b0fcbfe0edc318d79ede6dcbb2c4b34dccbace91d3775001187c3c96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084170, "uuid": "16c1d9ff-879f-414d-8767-16416e8fd41a", "comment": "Malware payload (OskiStealer)", "value": "cdf77517ad5c833941b15efb29edec14290d11a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084170, "uuid": "7db30201-0dbd-4df1-8a2f-768dcb27a177", "comment": "Malware payload (OskiStealer)", "value": "9aa2ebfce7ce2c65be2575a1607e9c562c16c5b15b4637e176f47f709beb6c996ba1deb74513e7b5981d2bf9367bbd2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084170, "uuid": "9189d390-f5e6-4b17-8a87-ce10f3d88b05", "value": "T178C4599CB12075EEF457D4B1CA682C64A691766A431F42039433F3A99E6DAF3CF44CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084170, "uuid": "e303e010-e965-46e4-867f-8f8fa59906c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084170, "uuid": "b9b77c0e-8b06-4a77-93ea-f07e57999605", "value": "12288:AgjjouC4Mi8RIA8CVuICkX2OHheeYACPIL3s2nuP88qO+LXz13TCiG9+856m:Agjj3rYIWrzX5BaPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084170, "uuid": "d29bad14-e39a-42b3-a7af-0d07324e4b33", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084170, "uuid": "1e50c825-b1b8-4603-90dd-68c33526d358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084170, "uuid": "dc0dc501-7757-4fa1-aaad-cf149dec30b6", "value": "Inquiry Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4e0363-cf8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652096172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096172, "uuid": "61047221-5cea-4f19-994f-f1901ae6fb56", "comment": "Malware payload (AveMariaRAT)", "value": "9928f5e8f8723f1170d22a3c09735e7c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096172, "uuid": "fa1940fd-128a-4671-a322-b7b1d2a31411", "comment": "Malware payload (AveMariaRAT)", "value": "127eec01b055b7539dca0924ddfc3ce99eb9f56710fdaa694d374fdcaad6ed71", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096172, "uuid": "e87ee353-f73f-4c81-aea8-f6c3fa143d71", "comment": "Malware payload (AveMariaRAT)", "value": "6b894cd2a6ce2110e6d1445421b60b47cc324cc6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096172, "uuid": "cd803f9b-43b7-401b-9af7-a5fdff0fcf76", "comment": "Malware payload (AveMariaRAT)", "value": "b0c68a247252b50608d1fef11c054f1116a2186ea298304620d22c9b7f80d31b92ce5375667d9f15f3fc1a4bc4db4ce9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096172, "uuid": "d13ce2e5-732a-4f93-98ae-cdd8546d5ef3", "value": "T12BD4BF891BC4F854DB3F7730BF64A21083F0A3CB99BA875B44C995E5BB21785B6812D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096172, "uuid": "b800a44f-0363-4dee-abd7-c78fe2afc0bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096172, "uuid": "9a835ef3-c331-456a-8c7c-a8d442206098", "value": "6144:67qaTQlAN05rC10qRMTERK1cMs+hlK+bnY29j/5EOts5RjNzc8E7/c22GmQmhRs6:B1fjz4ZagOG7MRfmbsSNi6AVS0GkEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652096172, "uuid": "e5a2dfcb-61a9-4b67-930a-a68c395b3860", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652096172, "uuid": "082ec59e-78ae-438b-aaf9-969ba366d2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096172, "uuid": "275bf0f1-1936-42d2-863e-d4e51ed23552", "value": "SecuriteInfo.com.Trojan.Siggen17.49587.31123.20321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09490fb1-cf72-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652084923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084923, "uuid": "740d1e02-f5ec-4641-b9be-b5a7d26014ff", "comment": "Malware payload (Formbook)", "value": "44e26b676a30b177456df992c58e54d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084923, "uuid": "9779f7d9-2ab1-48b9-944c-f92d91370cbd", "comment": "Malware payload (Formbook)", "value": "12943fc8f2a6c50269500379f4bd7c1e9eff514178699dcc90b0447f1bf4d75b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084923, "uuid": "9470d1e3-b2fb-4d5c-861a-c2d8c1285b26", "comment": "Malware payload (Formbook)", "value": "2446d2fff20385628ae1f1ce1dd1bb189f91e6e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084923, "uuid": "0523a50d-ff9b-45c2-87db-af23c9306b7f", "comment": "Malware payload (Formbook)", "value": "e41d72de32dc40600a6f5510f4a4ddaf410adb8bcd349e2638b72e867a30ca4f89a0a3ae4279316bcc3866f33a6870d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084923, "uuid": "e2ecf2bc-4f8a-4ab7-8fea-9b63e8b637bb", "value": "T1AE33171A789A9619C6D4BFFC99F090962672BCE10524C18FA8F97F19AD33323CCC521D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084923, "uuid": "9ed6e986-7ddd-45b0-b2f7-69330499236b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084923, "uuid": "f478e81b-76a3-4a70-b748-2d98c260866e", "value": "768:axPLAf7dVSOYfCc4GGUAxlmMwCK/3deVDek:qLgDSOSgvUA630VDek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084923, "uuid": "4cd7f527-db0a-42e0-b599-da2613fdb811", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084923, "uuid": "1cbffd88-5ecd-4c6d-a0fd-6889109ea998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084923, "uuid": "213a86d0-481a-4c2f-8ee0-d2d3542b19aa", "value": "ADOC RFQ-WCMS-1800865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2ca77e-cf8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652095984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095984, "uuid": "4730c863-8323-4587-85fc-2b832cc28d90", "comment": "Malware payload (Mirai)", "value": "6e46eaefdf81953bdaee03c020d3bdca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095984, "uuid": "4bf572ae-dd3b-4d86-8647-8bb261be038b", "comment": "Malware payload (Mirai)", "value": "13eec8b1468c18490d0adc455bbf88d98a586562939cdb075d353137c4d8b9b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095984, "uuid": "23107424-ced1-43ea-9c15-e20500a19766", "comment": "Malware payload (Mirai)", "value": "c28978bff42da41624409e97f0e5bdcb59552e8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095984, "uuid": "3356877d-afa6-4a40-a5f2-b8839b136644", "comment": "Malware payload (Mirai)", "value": "4b90657459f8bff1e2ca5aba72efb6084b8094aeda4421cbfd92c8e23c0e50c4c254b8732fa9a786e7c5a57e267b1b45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095984, "uuid": "9a5dab7b-3923-42c5-99f3-79c17472c3af", "value": "T113832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095984, "uuid": "f6b62d9b-436a-4878-8ad1-aeec66e69bd6", "value": "1536:qLf0+QM5PHyVwi7f2GUiEy+DlOo77L3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fL+DM8SJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095984, "uuid": "3e060320-e71f-4835-a545-bf857a217e68", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095984, "uuid": "581f1398-6663-437f-b071-3230660fd141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095984, "uuid": "c890096c-2350-4719-9a30-33b78f12af7b", "value": "6e46eaefdf81953bdaee03c020d3bdca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526261a2-cf77-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652087193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087193, "uuid": "b9c41524-e230-447d-8c81-494715acfc87", "comment": "Malware payload (GuLoader)", "value": "2f8ff2e82fc8bcd359c796abbabffe40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087193, "uuid": "15b39912-dd99-4f47-99cc-7e9ed94f9380", "comment": "Malware payload (GuLoader)", "value": "14115c480b85aae0a6e312125234880649b933b5a81936deca0db43153f4921e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087193, "uuid": "530c7d31-8a7e-466d-841d-c1287aeeea84", "comment": "Malware payload (GuLoader)", "value": "d3b5ea7a40a09e0cb0250e613ea035d5f321b44b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087193, "uuid": "9e61ea65-cb9d-4117-9944-c202c3f1d0fe", "comment": "Malware payload (GuLoader)", "value": "2364c16789acd997e06137ac73e9eb651a68deb964cf61a4cb9e2c3bef44b59413e8b8862938135fc5aac834fea915d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652087193, "uuid": "3d934054-dd6a-44c6-b1ee-83bc6e817fbb", "value": "T11405128266998592E7715CB152BBCDB20EB1EE303E85090B6BD43DCFFB66B41BC15243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652087193, "uuid": "ae1495b3-8388-4378-92dc-070b6250ece6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652087193, "uuid": "9801b481-32f8-4140-b821-e6fff94ab51d", "value": "12288:NYTKndFmddzoAjMIg7z2BBH9JBXRqLcH3iRpPwRA8HRIVyyEEwi3LOfNzHWY:NYTq7OPjMzz27JlH3iPwR90Dr7mz2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652087193, "uuid": "5b7595b0-dded-434b-8b89-84dd48e2fea3", "value": 813152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652087193, "uuid": "4c3950aa-0933-447f-872e-f764bcbf3843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652087193, "uuid": "ba0d850c-7ae9-494b-97bd-70070d409823", "value": "Transferencia desde ING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c949523-cf98-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652101303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101303, "uuid": "5e85f5ae-ad8d-415e-97b1-375101727e29", "comment": "Malware payload", "value": "59c83ddd69f07c8affd87edf5a4921e2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101303, "uuid": "2f17ac44-bab7-4d3e-befa-d7b37d511b68", "comment": "Malware payload", "value": "1488a0e023ef1a2900d94116e807481a3ce10c030a26cc6575f7eca34a842271", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101303, "uuid": "dc91c074-eed9-4cfd-8e0a-10ca81c70584", "comment": "Malware payload", "value": "a89a21a2af4a5a59c35b42c942d8ccc88bf6d88d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101303, "uuid": "8603cf2f-1383-4c26-bc91-773e716622ef", "comment": "Malware payload", "value": "2b80036131376a004cd91abc94a6a0bccacca170a4c3253637375b4ad746ef5308145ce9c1c3cd89a694a93aa75963fb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101303, "uuid": "0f710be8-7d98-4b49-b758-729baeb1f10d", "value": "T13E63A593EE0360B428772A63BD2BA2DDFBB0509794251854FE8D08852F7978DD3B079D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101303, "uuid": "4efdcb77-7519-45e9-905c-1952c320afa7", "value": "768:wMrsH5J91uCYifOtLfOWY5eZxpnd/EGwltpxIpzNXiUuciT6dezKMUuGSsJh9Ll:cf14imtPi1UNXi6de7UuGBh9Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652101303, "uuid": "b6934c80-a60f-454e-a959-869565fcf3e2", "value": 69138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652101303, "uuid": "4a259fbb-e599-45d7-a645-fac60d6d2dcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101303, "uuid": "98893d97-7136-4f0f-9036-38b04cf39bc7", "value": "Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14014770-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652109851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109851, "uuid": "611863ba-c89a-4075-8ba2-1835e1d21da8", "comment": "Malware payload (Loki)", "value": "47ff8ccb6a8733906dfb61d7c03fde8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109851, "uuid": "3b84396a-8351-4008-974e-2dcbcd7ec92c", "comment": "Malware payload (Loki)", "value": "1492c0e4ee79d6417b749a82c453357ea8a072aaa87ca6184b4d6a33920cb7fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109851, "uuid": "c1627663-c2de-443b-824d-08ab1e830cef", "comment": "Malware payload (Loki)", "value": "7a3c2b6abb8a52ee2dd313fa9c7907bbd02d97fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109851, "uuid": "9e796268-29d5-4242-a487-fb6078e6486b", "comment": "Malware payload (Loki)", "value": "9eb43e02ec966c4eb2e48394757379da7bdd986da0cbf13279e2efecd37d91bce761543ab542d00fe86f386bcd94d5ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109851, "uuid": "f36ee808-d1ed-4d19-9b31-6c0d14c55727", "value": "T197F3021279D1C8B7D8A2C3710D3E97AA8BBE86161595474F1750AF9D3E32782CA0E733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109851, "uuid": "f6003d7c-9d28-469a-99bf-db5af35ce728", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109851, "uuid": "87bc1111-57a5-47f7-abc3-bded386061e8", "value": "3072:l1NjcVVnLpPunbq0jSrg0wh9b6kDBi7Is0+vhiUPcJdsQBzhbitIO:HNeZmq0urg0qNDoP0+ZiUE/zB9bitx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109851, "uuid": "713bd22c-3acc-4c01-bdc8-f10269272de7", "value": 161705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109851, "uuid": "8fb114f1-d60b-4e2e-8dbb-0e2a0b78bc09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109851, "uuid": "d5624cb3-25dc-4c95-aac7-9f5421cb567a", "value": "47ff8ccb6a8733906dfb61d7c03fde8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078f872a-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652107254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107254, "uuid": "98ebcb3d-1787-4ada-be89-2dcf2d3432d8", "comment": "Malware payload (Mirai)", "value": "cc116f0e680775adb1536219a90ea033", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107254, "uuid": "ef6114d3-fe77-4404-800c-3154a706e5ef", "comment": "Malware payload (Mirai)", "value": "14d68e8eadaa17c5b564f2f25af3590aead13b03f137f84a573b920204ceb0cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107254, "uuid": "96762581-dbe5-4332-8c0d-88cf67ba187e", "comment": "Malware payload (Mirai)", "value": "29947fa07464f75dce96166f4a3aa2bcc5b852dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107254, "uuid": "6c57ad3a-262c-4076-a92b-28d351a237a6", "comment": "Malware payload (Mirai)", "value": "2ac39bbf3a9a178c84632208a5eee8cba94b6c24f3d87d0c86a1cd3168175c3efe58d90aa8997dbaa32df733fb6b5eb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107254, "uuid": "c5d4f6da-c306-4271-beab-ca016e579843", "value": "T1E8C2C0BC190545E2C59D80B9CF9A17906FAA1E82F483D54B7C56D792EC997F0B8C3CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107254, "uuid": "e23a1732-88a3-4f96-8f90-1358fd4136d3", "value": "768:Rn4SpciEhe/R2mcEzcIzhnhGzU4NaTPax+JgGlzDpbuR1JH:dlOQcEVzhEForaxqVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107254, "uuid": "aff2aa2c-918a-4b69-8d07-8ea247312d9e", "value": 26432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107254, "uuid": "0db7ae58-a3fa-42b7-8c5a-b08506462d71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107254, "uuid": "28d6a5be-d490-411c-a6d5-5fc4403087f9", "value": "cc116f0e680775adb1536219a90ea033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370fb387-cf8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652096166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096166, "uuid": "9515b3ed-cae2-4f57-b15e-8e455444e3be", "comment": "Malware payload (SnakeKeylogger)", "value": "02f4b1544734aa5bd2b3c6f54f6b9101", "object_relation": "md5", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096166, "uuid": "17b2b5e8-d423-44c5-b3c2-4fdcb4e9cb4b", "comment": "Malware payload (SnakeKeylogger)", "value": "156be1328dba91ef1949b28e25e3cbe49ad24a6782cd302eed3193571b7518dd", "object_relation": "sha256", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096166, "uuid": "90b722a0-5b56-4f08-8280-00bd4812d322", "comment": "Malware payload (SnakeKeylogger)", "value": "fa0b387991c630b1252bb0044eaf1860f7e9b30e", "object_relation": "sha1", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096166, "uuid": "f0cebcec-a20d-4e70-af2b-00a4d071ec92", "comment": "Malware payload (SnakeKeylogger)", "value": "220a9d41379788fb631701acb9dfad04cbd9d6ea89a4d7320cba71fe222c030ec041622adab3f14d5eda7973f8d58849", "object_relation": "sha3-384", "Tag": [ { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096166, "uuid": "dd0f9ea7-be57-4d41-9b9f-75b6235c2ca7", "value": "T113B423B129D3CD533CC1ED350CE399B27DC6BE6BC8009B7A1D969E9152D3ABC66004E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096166, "uuid": "55a8c59c-b866-4949-82ba-338e4bc31247", "value": "12288:luAPtsIxAvwPV3+0DHWIRItPowZSHJo+s7w:luotLxAvsVjFWtPowoO+s7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652096166, "uuid": "5d52ccaf-87df-4891-80f7-1a6f57327252", "value": 538700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652096166, "uuid": "f230decb-1670-4c4c-b846-6a8e77c2247e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096166, "uuid": "f6a98577-0dd6-4aa8-b044-3afbab6c1327", "value": "Phosphoric AcidPR 120006486PO 120008190.pdf.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d997a93f-cf98-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652101593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101593, "uuid": "c685afbb-1899-481a-bf82-b72646d50115", "comment": "Malware payload (AgentTesla)", "value": "7103363d928ea864e3974f02dea4cbb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101593, "uuid": "404f24ca-29a6-40a6-bb2a-9dcfa0309cd3", "comment": "Malware payload (AgentTesla)", "value": "15e7344a0c408dd0b37b2fb22bc56b2fd3d1d723f6dfb70cbf1aaff61de98624", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101593, "uuid": "b0b87fb4-5579-431d-9b4f-4693f4283e39", "comment": "Malware payload (AgentTesla)", "value": "765ae00b06095e93f0a582716a9127422a25d1b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101593, "uuid": "efa19393-091d-4a74-8680-4b9bd1dd4814", "comment": "Malware payload (AgentTesla)", "value": "cda779a41e797f989770de0e96fb10c4d2bb1fde4b241bb608701396280edf836a218d587254971ab4b3df2fc6b80c78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101593, "uuid": "11dfc844-e673-48b3-b123-c029527d847e", "value": "T1DB040923A17CD5F2F89C3DF84A0897652AB06E920675F14BE44FBDC6E8B3A23C6051C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101593, "uuid": "bf1de7bd-4d10-4b06-aa80-d97740ded863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101593, "uuid": "34cb7a92-baf5-4779-8c24-20b3c19520eb", "value": "384:jy0f6nQLh58fvr3Av7Nu3YQmHNUK6kcmiUKsMQmZjVBjN4IXQxxkSlSlSlSlSlKy:/f6QLh583m7NuVKxcV2m5vqGsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652101593, "uuid": "c18f9bf4-4df0-451d-b60d-563c595eb13c", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652101593, "uuid": "fd8f398c-73c7-4919-af28-8c94ce274116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101593, "uuid": "87b2a1db-a77f-419e-95dc-fa403f895060", "value": "ETL0586300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218e2e5b-cf7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652089688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089688, "uuid": "67c0ccfe-1718-44e6-b242-e40f2a625277", "comment": "Malware payload (Mirai)", "value": "05645594bf0fbe29ba8ad77dd8576a57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089688, "uuid": "0e4613db-99df-4e1b-b235-413d02e1cecf", "comment": "Malware payload (Mirai)", "value": "16015d2c26e8aff6e44b28fab3ea01c339bcc6f26b30e503b9667c8a37a797b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089688, "uuid": "06cd2234-1a81-40c0-b48b-407a0ff8a5dc", "comment": "Malware payload (Mirai)", "value": "823b25c895cbefd36af95882410cd145977d4367", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089688, "uuid": "26b2bc53-9be7-40a0-86eb-0ed7bcb32fa8", "comment": "Malware payload (Mirai)", "value": "77c99af05762c81acefcb1e74fdf924971467ce2094409170a1463513d095a4bd68d60c1f77ee7b1731029a08953cd8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089688, "uuid": "13b2d472-80d2-43b7-bd3f-365c377a368c", "value": "T10193D81D6E219FBCFBAD863447B34A219648339627E1C685D15CEA012F7034E349FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089688, "uuid": "a7c4b377-7383-4a74-9c6e-259aaebc0c37", "value": "1536:qJv3Q/p3+dzadtxFAqpD3ZUxWZYRLKrFDpe5+Tpu3t:M3e3NxFL9UxWZYFKrFDVTp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089688, "uuid": "7ccf77d9-28f8-42e5-81c8-44c36b705d04", "value": 93456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089688, "uuid": "1b003b60-b078-48e1-b4e8-db93f133a7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089688, "uuid": "cd870085-a829-47d7-b46d-d9d4bdec29f6", "value": "05645594bf0fbe29ba8ad77dd8576a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e320ba95-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652104615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104615, "uuid": "2e32bf55-2f66-47a8-ac5c-34f8691e7de0", "comment": "Malware payload", "value": "c192ffb551e517687569449fb96f9acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104615, "uuid": "49858fba-0c6c-4d53-8c16-bfeac41ada0d", "comment": "Malware payload", "value": "168def17ca34ac8e71b779064ddda9f3113ed4e4eb99dd24e25793d9ca6e64e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104615, "uuid": "29c96a44-e9b4-41b4-b26e-41ead1307e69", "comment": "Malware payload", "value": "38df064b4032ecdfb9226d6bdc6198c97f8d95b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104615, "uuid": "0c9f9a0f-4ce3-4a4f-8a38-ff0b752b9feb", "comment": "Malware payload", "value": "59a7e186097e9cafd28d8afac09cc109ffd1121a19f709d361729f7f48c92ec0026d6e1cd0757b0058d53694405bcda8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104615, "uuid": "e6a85921-68ec-40a0-bfbf-4aa97c60270b", "value": "T1DD0612A92198335CC42FC8749433FC41F1FA961F0AF495A975CB7BC07BAB521E682B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104615, "uuid": "0790573b-8884-4898-b5cb-f473f7084599", "value": "bb46f1abb2c1ede95f964a725f9d1284", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104615, "uuid": "afed47cf-c2bf-4549-8569-512f48ffdd35", "value": "98304:5Xk8w72NoYyObTfhkRyjudrA1vSVdt7P:5Bw7yyObtkRyvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104615, "uuid": "fd248ffd-cffd-4473-8d94-4e9759050143", "value": 3678720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104615, "uuid": "f541e7bf-feee-40f6-867a-187f29edacd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104615, "uuid": "39c58edb-db33-4406-9ac2-d22798e2bb55", "value": "c192ffb551e517687569449fb96f9acb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f54540b-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652104502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104502, "uuid": "fc6b4208-7096-4e15-ac15-c3bdb4b38348", "comment": "Malware payload (Smoke Loader)", "value": "e31a18f7be10ea5242c5573fb5574cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104502, "uuid": "dc4d4c09-2f1a-4b49-8b8b-c8b1c4030561", "comment": "Malware payload (Smoke Loader)", "value": "16ab238a5b8fc0de74ddda698db8182e8193e65f7003124a0f954313cf86e048", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104502, "uuid": "cec61662-5d6c-4519-9b34-34953cd27b4c", "comment": "Malware payload (Smoke Loader)", "value": "74f5bcbf952ec920291a910301afbb3c10dfc148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104502, "uuid": "8456fdff-31f9-423f-bbd2-4b89c19183ed", "comment": "Malware payload (Smoke Loader)", "value": "23c2991d51dd445d14e916536487f1a9763e946358cca3cc933e22817a3fcd04a9b84e86e41df9212c9b58cf1e1a2932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104502, "uuid": "71b0c818-d759-4256-b238-0dc14988a553", "value": "T16DC426C573949053EC575A304EA383CA9729FCD0BE34359B2365F32E0B3AAD26E65706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104502, "uuid": "c56ee234-af51-4209-8bef-b38f5cbb70ac", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104502, "uuid": "c513961a-ac4e-4e7a-af4f-1308a8985b25", "value": "1536:Srae78zjORCDGwfdCSog01313qs5g8ApbptUqAgQbVKfc2Q+8iAF:aahKyd2n31T5IplqTXVKfUDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104502, "uuid": "c47aca3f-618d-439d-a260-4c9311ec5246", "value": 561432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104502, "uuid": "0a2b5856-a711-478e-8d13-842ecd7da8bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104502, "uuid": "c3bc8d39-5cc9-41b7-9930-330c6f378ebb", "value": "e31a18f7be10ea5242c5573fb5574cb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec9b4bb-cf48-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652067135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067135, "uuid": "f17329ba-85e1-4367-85c3-97f200eb442a", "comment": "Malware payload (SnakeKeylogger)", "value": "a589f9d45690ccef0522e03a921b41ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067135, "uuid": "5c1934c7-dde2-4e36-ae1c-7639ea81c20f", "comment": "Malware payload (SnakeKeylogger)", "value": "16c9ef9684c42255f47a495b2984e99f3227d5a13f899c9eabe89ed831a67204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067135, "uuid": "d45ebf19-65c2-4c43-80ef-3c4f6a919c36", "comment": "Malware payload (SnakeKeylogger)", "value": "c66e1db94bcd054704049e45663a19756d1af798", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067135, "uuid": "283cc48b-f273-45b6-a58a-9d0e4515fddf", "comment": "Malware payload (SnakeKeylogger)", "value": "7e014ef44399f644a51f02f5e4b8f929a64c595f2a945adc5879be1b976bdaf48d1e7ad8871113f2894c376f1e5d3d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067135, "uuid": "0550bdbf-3d84-4178-9213-7e588bd62421", "value": "T167A4389CB12035DEF85BD472C9682C64A691766B431F42039433E3AA9E6E5F3CF54CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067135, "uuid": "98d9368a-c348-42a9-aaa7-0f4b9fee8731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067135, "uuid": "e3c95c8c-92d1-4a62-9a54-aa97b7e671a6", "value": "12288:1gjjp6vpdoTJfrTPKOhTKxojuWKdttmb+SSLaain6m:1gjjUhWprDKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652067135, "uuid": "3a45b941-8515-4fd3-b798-037395ccb220", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652067135, "uuid": "442dc28a-47cc-4be6-881b-d1b0a07b1188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067135, "uuid": "fe35326f-7051-46a0-b353-a31cc18aa343", "value": "PROJECT SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea639bc4-cf50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652070697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070697, "uuid": "4450b97d-a358-4671-a8f8-1d62c8170b22", "comment": "Malware payload (Formbook)", "value": "e77f444a6c3be2876e83bac4eda590f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070697, "uuid": "1f75db23-b3d9-48c9-9965-ee54ec87bb91", "comment": "Malware payload (Formbook)", "value": "181b33c4cba7fc9aad25283ed5fce1f171f8fb64af1591bfe5c38285a7091956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070697, "uuid": "6145530e-4c2e-4f2a-8c6e-69f5c20a676b", "comment": "Malware payload (Formbook)", "value": "b0e06ff555feea21ee353ebb002496f5a8671c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070697, "uuid": "7f569d2c-8482-45e2-84a8-cfaa89cf4c84", "comment": "Malware payload (Formbook)", "value": "7f978d3c64228caf5988466a4ee1db6586a9659519a38694bc28a1dee81e2d6483ce7413e0d0b95c5c05633b288a9f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070697, "uuid": "d9bfa018-354f-4ff5-a72a-7e89784e9760", "value": "T176A44E2C7B0E0AF6FC1F9130894D0A58FFA25B436240B9975BDB15FA8B4F1665E848DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070697, "uuid": "60d2aad9-301c-4344-8d27-417e92d6c14d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070697, "uuid": "fc2e8f6b-feb2-4945-a693-dd567d8ac7c6", "value": "12288:qSawujxzbQawPoQtbqinqXh4ZuHjVih8lWACcbMYvQ4pf:ZujhuPLd1s4ZuDwhZTcAWQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652070697, "uuid": "d3f503db-9b79-428d-a272-f6d3da2b74b5", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652070697, "uuid": "1a4ed905-fcc5-4032-9860-6a9ac33a6bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070697, "uuid": "d39cac02-68e4-40ad-981c-f0adbd8dc09c", "value": "\u0110\u01a0N H\u00c0NG M\u1edaI \u0110\u1ec2 MUA,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cce8769-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652105142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105142, "uuid": "d6c61832-48ca-42e6-b9ea-1706a34e56af", "comment": "Malware payload (Loki)", "value": "9d3b0f1fa135dcbf2ccf47a31d9be96a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105142, "uuid": "dbeb93dc-bfb8-4ba5-b70b-704a50404d82", "comment": "Malware payload (Loki)", "value": "184072f5bc0ca37094116d0b9d105688492b19195ac7d80bfe0ff180798d35fc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105142, "uuid": "fb357b66-9a01-42ee-9ca2-03b00063e70e", "comment": "Malware payload (Loki)", "value": "6daa21ebc988e86394f94469e803a5fff73bfc6d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105142, "uuid": "1138d37c-a6ae-4f4a-82c5-2450ac8e9ca9", "comment": "Malware payload (Loki)", "value": "e47bf19f72d30b400fcd91e7b305869cfea5aae2ea45d5aada4bdecc550c27f68c0b90a060a33d578695afcae0839bbd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105142, "uuid": "d10e38c5-8e62-49a8-b631-aa9ff37fc757", "value": "T1F92412A8F6A90583D47517B4D8E9F1FCEDB2FD82C27571F8094832893F3B4890522E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105142, "uuid": "4a771a63-5ec1-47d3-bb1f-71c29d695795", "value": "3072:KxYcPTRqMjzj8SA5jTXKN77xixZ3DBYwm3X8Qw8zFDj06541CHYrU786:C70+jRA5/K+j3DOwmn8Qw8d0y71786", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105142, "uuid": "6c6d13fb-d114-4900-b1fd-1b072e031691", "value": 211560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105142, "uuid": "ffa31ab0-2c14-433f-9c34-fcd54e7461c6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105142, "uuid": "aeb8e0af-03d0-4644-b252-a81f51ce39f6", "value": "PO.922001104.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7538e948-cfb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652112162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112162, "uuid": "58cd11c7-4d44-4402-aeef-e2be4d8cc4bc", "comment": "Malware payload (AgentTesla)", "value": "96b1f5de840e185c2b7bc77d1abf5efb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112162, "uuid": "cca4f4fe-5ee9-47dd-9e21-286e65a8afa7", "comment": "Malware payload (AgentTesla)", "value": "190a5d0472acf35cb559ebc92698938f6889893a5f7a705c4ab945f4ffe4c391", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112162, "uuid": "c537e821-40a3-4118-b0d2-b7c168e449c2", "comment": "Malware payload (AgentTesla)", "value": "90eecc880d998f4f3e211ae22ea4b3189bffedab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112162, "uuid": "8c8a3394-04ce-4330-bd43-508fe8d6fad2", "comment": "Malware payload (AgentTesla)", "value": "127f829bab43cd65cd300606a4ce85ad238b54acab65aa5aadd7ae795cff966d38adeab39eaaba3feadf94ec05ca972f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112162, "uuid": "fa00fe24-1848-4809-918b-e55d6dd20a43", "value": "T1FEA4232CC8FEFEC5518B08EBD75A4D7E79929A5A300E061840524CF46AE673FCE911ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112162, "uuid": "18a7b47b-65d9-4a62-a93f-ca6b27c88668", "value": "12288:/3fn3ozOmJsQI+uxQKIPzCmijTVjdje5V+fJWtaaMCLq:/P3onG+MnSCbpZergJWtaao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652112162, "uuid": "e99f01f2-8b71-4f92-93e4-d41b250784e2", "value": 453864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652112162, "uuid": "8a836418-ad05-4cda-954d-148f2a6491cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112162, "uuid": "18352783-45ea-41fc-83fd-82a6c3425a5e", "value": "HBL+MBL ADVICE DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3307750-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652107085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107085, "uuid": "42b02ce6-d18c-4943-bbf0-f78c9ed812ed", "comment": "Malware payload", "value": "2fa6f4312832b18ec8ee0c1a7cb3ec20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107085, "uuid": "cef97091-415e-4aab-804e-7c0e8c88270c", "comment": "Malware payload", "value": "1926a76432411b5b4872e88e75353c7f420920169fd55168d03b4e68d033e4dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107085, "uuid": "478b8823-aa1e-41f3-81f9-4ed8ebf73f81", "comment": "Malware payload", "value": "1bf2f1b1834eb25673e696e316d17cc94bbd7845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107085, "uuid": "410238dd-c082-43ab-bf8e-39601627a566", "comment": "Malware payload", "value": "30af41706164cca75ec4a62e00a23919f6a912fa8929d11e87bf7a319106c9e5721cce43b68c126cc77dc7860fb378b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107085, "uuid": "331cf269-345d-4265-8435-dba3e6c776e3", "value": "T1D335BF42FBD719F2E982093D40EAA73B9A3577150735C9C7D7802812B8E17E1AF79398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107085, "uuid": "4937ec1a-349a-470e-8ffe-dc2066aa40c6", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107085, "uuid": "d9eac87d-4217-4d02-a220-9433a0a3c575", "value": "24576:z6T8Ujl6vO01C1GCTsYoQZtlsZdc40QDrUYuGG1ihTGTTi0CJcupMnSaTK:lTUwTGTTWcu2nN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107085, "uuid": "3f0e8eb2-2f00-4d56-a855-5d7eb69e04b9", "value": 1058488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107085, "uuid": "797c0c8f-6160-456c-8fe2-6ae8fb90124d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107085, "uuid": "6b7c227b-bc0c-41d8-a292-7bd6071a4f92", "value": "aliyunssl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3a85e9-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652109922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109922, "uuid": "7c121725-8624-4c41-ab5b-9a0632686da7", "comment": "Malware payload", "value": "9108b01d063cdd72902ad751f19977c7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109922, "uuid": "c45c8594-0584-458e-af45-1de6b56eb090", "comment": "Malware payload", "value": "19896819aa60fe7a53fd21e0004a0d3fb33f2b4e331cbbcab0f33221f9a6d520", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109922, "uuid": "103829fe-e90b-44a5-9b7f-599a142d1280", "comment": "Malware payload", "value": "6de1b6c537aad6b97f64a4375c470bd96f6183fc", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109922, "uuid": "9ed675c5-79ed-4748-833f-03d69bafff17", "comment": "Malware payload", "value": "655f95d1bf5af6c1b50ba3a14c3a2d0388e09281d637a929eeab3206f9747521ffb4463323cc64e3d86916a9c3369d95", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109922, "uuid": "9cd2021a-f3c0-4f7c-9d86-b78e774a9373", "value": "T13EE39F835048B876C3514D3B3BE059A731462820E9E0844FB7DDAEE517AFEBE36847D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109922, "uuid": "30d6aeb8-589e-4063-86ce-28185db462e0", "value": "768:8Cx3GvCXMCdIsUxnQKTlufCQ5l0UFpGRnBM5uTK6wWmT9T5PyVNz0:7DXMCCnQWlpyl0UFURK5uO685aVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109922, "uuid": "b7e5802d-033b-492c-a9a9-9c50c75d35e7", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109922, "uuid": "a7fd7b93-5072-408b-b0a1-b64de9e8f1b7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109922, "uuid": "253bf341-6b2a-4154-8a59-8f27cf3cdb85", "value": "53342231_Invoice_Confirmation.exe.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257540de-cf76-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652086688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086688, "uuid": "b3ac1426-22fd-456d-bbc7-41eb8f9f0fd2", "comment": "Malware payload (AgentTesla)", "value": "7f2dab2f8de63fa809240910d1df3dac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086688, "uuid": "0191c642-300e-4dd4-9d33-86aebff7b5ce", "comment": "Malware payload (AgentTesla)", "value": "19a74b73bfbb078a9a9fe5c0789d7d011ea547dc2f6a8e17f44efe7c5dffcf57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086688, "uuid": "af7ea4d8-4ebf-462f-80a8-d38e06f313d3", "comment": "Malware payload (AgentTesla)", "value": "783199796dbad07fee78527caadda3f66df55c54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086688, "uuid": "b1f225aa-a1ff-42ed-95a2-416ea59773e1", "comment": "Malware payload (AgentTesla)", "value": "ac5c3bc087599c46ece4de822bfa587bf359b70c27e988cb414600c0e9f7dd9c6c301189e94810a8180b5901371302d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086688, "uuid": "c5479ee8-7e4c-4684-803e-4fbee44660e8", "value": "T18A04A381D4DC3CE0D49605B42CBABB50311EEB5EA82A1E59BE73B52986760E73073D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086688, "uuid": "f35500f7-3bd5-4a54-b6e5-efc5d32dc031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086688, "uuid": "c192a9f7-136d-4dc5-9679-67bf789a2f4f", "value": "3072:S1HtJFBG3Qxb6OiLfWX4TfX4t4KAX4eAX4AXRX4Mmn4A454AX4OX4pX4jAX4AX44:uNJb0r7oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652086688, "uuid": "0c8a0e28-fbaa-445f-bef9-bbfbb30bf8cc", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652086688, "uuid": "e196b6b9-f590-42fa-86a2-10dce3e23aab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086688, "uuid": "2ac04f0e-b6c6-45e0-933c-67ce8ac29549", "value": "PO#2022CTV05-47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3612c79-cf93-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652099462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652099462, "uuid": "d5844175-0c71-464e-bbf6-14ec309b48d8", "comment": "Malware payload (GuLoader)", "value": "ebbb994d553f934b7b1dc05351bd64f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652099462, "uuid": "0995f32a-2074-40d1-9e4f-5cc771d94804", "comment": "Malware payload (GuLoader)", "value": "19e5b14651f7ad050e2b9dc95e5bb7574a8fdde378bfbc7101ee7e2276c23d62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652099462, "uuid": "1c43bd8f-c9a5-46cc-b6ea-06b001d13646", "comment": "Malware payload (GuLoader)", "value": "7244b500832b2ed4d01306e2c6406e51e8fedebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652099462, "uuid": "5feb95dd-b18e-4795-b20f-0170892bec56", "comment": "Malware payload (GuLoader)", "value": "d5c7f00c63f68ef05686103154709bf2542b31bd1f7d060bfd6149fc7a930209fa7827247b2e1c9d7df57962966137cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652099462, "uuid": "a2845879-edea-49e8-9bd5-697abae4ca34", "value": "T1A344E01D3615C0D6F88943716B36DB071A9FB843268215173BB1BAB89B353D3DA1FAC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652099462, "uuid": "7b32a775-b478-4407-a314-10c44689da80", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652099462, "uuid": "131baba8-1d50-4398-9f4b-f9fef4390dfc", "value": "6144:x3yzt4lmkDDtNo+JfRdPHhc21c9Gr9gUDm3vxNT8:x3HFf/L55HO2KGBlDgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652099462, "uuid": "f8ae0d0e-4b0e-4f0e-a4eb-15282a3ae1c1", "value": 255552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652099462, "uuid": "2a0a5913-f887-4155-9917-dbe9e27c9041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652099462, "uuid": "319037e9-c796-4970-80b3-0dcf8cdc9a1b", "value": "potwierdzenie wplaty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec19db8-cfb9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652115453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115453, "uuid": "987180ec-ba84-4be4-b3a1-86c6b7319f42", "comment": "Malware payload", "value": "623188e4e000ac1a9bef7370c0a7c8d8", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115453, "uuid": "71d7cacf-b304-4633-a3fe-7e8151d38e47", "comment": "Malware payload", "value": "1a5dbff80ba1a6061196db8b27033a38c154d1822f6de2f9affc0631bf8e82ee", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115453, "uuid": "43214f46-16a8-43a8-b9b6-e170e653b11a", "comment": "Malware payload", "value": "7c8aa4610b905c445030b98100ab2258b24a3db8", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115453, "uuid": "6c26edf6-5270-418e-bf83-583ca212f7e8", "comment": "Malware payload", "value": "b1d67025575b93106174f84174b8db71547595bc6d457c479fd2809135f3bf123fecb1b5bc9e204e3b784b6b721e93a9", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115453, "uuid": "924b036b-0357-4734-bfe6-da28f32a6030", "value": "T180F48E22A3D34836DD77163D8C5B93949825FD413D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115453, "uuid": "5144f8d9-637b-4c0d-8e59-1b54b8f7d4a6", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115453, "uuid": "d4148aa7-b373-4913-993f-bef84be9e6d9", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPi/0Q1B0vZRzIBt:bUzrOKfQUDZC91UZRMBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652115453, "uuid": "38d06aff-630c-4ed4-8810-d16980dcd6be", "value": 783768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652115453, "uuid": "127a3b62-5b16-463b-a7a4-82873694eb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115453, "uuid": "6584e960-f8b7-4086-901c-457143957cc3", "value": "1a5dbff80ba1a6061196db8b27033a38c154d1822f6de2f9affc0631bf8e82ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b2ee36-cfd5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652127620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652127620, "uuid": "a7423d2a-dbce-483f-8075-b3e3ec2c10b8", "comment": "Malware payload", "value": "6f5ea8383bc3bd07668a7d24fe9b0828", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652127620, "uuid": "468960e4-441d-4f75-a635-64882b68bdd4", "comment": "Malware payload", "value": "1a5fcb209b5af4c620453a70653263109716f277150f0d389810df85ec0beac1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652127620, "uuid": "b97f84bc-5649-4c8b-95cd-f7bc583830cb", "comment": "Malware payload", "value": "90e00d255fc9162080c02510e7e10ffa6b6ed995", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652127620, "uuid": "9b77067f-3122-4975-bcf4-6f4c254e1ced", "comment": "Malware payload", "value": "2afd42ca4598c4d9bac48ec35216b7dde3f60cbe89279c133fc7760a2220cd3161de050ae94844600ad6e476ccae4dde", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652127620, "uuid": "b0930872-a496-4026-99d3-8621d1663002", "value": "T16325CFE1A0853385E1B6C5BEEE17B61793FDB64737227B4E0109828A2D312B77E19353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652127620, "uuid": "22aaf364-54eb-417d-896d-e591bff05bfb", "value": "b1489cb50186370c6e4ab66fb531339a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652127620, "uuid": "a389694c-2b57-4bb9-ae04-8f5cde914c0f", "value": "12288:P20eCAkz8ZVDLEjXXbgre8pWvT5jx5ey9RWWPZ0FmOUywShpzxoF2+OwjOT+oevO:P38Z5o4eFB9RWWPa57xo04chBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652127620, "uuid": "b5f8b7bd-90dd-44fd-a0a3-542f3436a3a9", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652127620, "uuid": "37765dc1-07f2-4298-ac6c-5a2c39251067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652127620, "uuid": "6e910c05-4042-4c0a-89bc-e9703e735c65", "value": "RIAFRES.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a985cdb3-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652104519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104519, "uuid": "04c54284-2a46-48e5-8de3-0b4edc5eb73d", "comment": "Malware payload (RedLineStealer)", "value": "3655690b42f1cb49af516dd1e9f0d370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104519, "uuid": "b7fee482-e14f-4bd9-9abc-ddd1c3609ab6", "comment": "Malware payload (RedLineStealer)", "value": "1b00d70c7cd527f5c069f75c95b340e961fb0824b37f84e643a39a0d14c89132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104519, "uuid": "120e605a-1cb0-48b3-a130-8fb00c291c32", "comment": "Malware payload (RedLineStealer)", "value": "83bb77fe1ba9dd84985a258ba717886ecee25c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104519, "uuid": "7f69dde8-2191-4b31-b97d-198ee794d315", "comment": "Malware payload (RedLineStealer)", "value": "2418751ef263c5145afc2921ce3fe9862fdfebf9994b6dec7b16c535a70de4f79fce44fc862d87c32698e3463e4ca044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104519, "uuid": "072dc709-8d1c-4be2-8be8-f7d410e5957f", "value": "T16484CF10BAA0D035F1B716F4497AC768793D7EE09B2480CB62D17AEE56386E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104519, "uuid": "d9e21a69-75a7-4be8-a710-f48f8e03713c", "value": "162bfa83d7bc4555a077d42813a965ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104519, "uuid": "5238733f-d506-43a0-afe9-44d36013f73e", "value": "6144:rGTgsYZ/KAkXL/x5HP0wZXvhQLIiiy+/1Y8C8hUqanW+3bM1+VQNlno:KcB/VOTx5HfZiLY/1vFanbM17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104519, "uuid": "850f5004-1401-4381-9ab7-46a6fadf329d", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104519, "uuid": "b47e8108-159e-4fb7-9dd5-171b21160407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104519, "uuid": "f3d5870a-c0ec-4876-867e-ab1f3aec5f75", "value": "3655690b42f1cb49af516dd1e9f0d370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d73d5a-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652104560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104560, "uuid": "39c49521-fc68-4239-8de8-60be0fcc2a53", "comment": "Malware payload", "value": "cab1bf1949d73027e5c6ace9d2ca1934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104560, "uuid": "d41336fb-aceb-4ca3-b4ef-a6e0f2fb3468", "comment": "Malware payload", "value": "1b5294315a9c27087587ecae0b447c6705c424f0f91f2ee22c9ed4a517ddba04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104560, "uuid": "4ae5ebdf-4b58-48d1-b96d-5bcbc4f9d4e3", "comment": "Malware payload", "value": "172019e90943c311e19ca45b5e7057ef9482eee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104560, "uuid": "e1410925-da91-4ae7-bf61-4993d44a11ed", "comment": "Malware payload", "value": "3b53cba5e41674a2fbd08fff27d8497525f4353402d82d06fe323660e69357ecb45389010dc8f284761d6bfaefc9eb2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104560, "uuid": "8db51451-6093-44cd-8a28-02da0e61fbb9", "value": "T1D5162358B8929432FD180EBC4F36CED65D6091AFC727D5523859FA008EB932FC6246F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104560, "uuid": "72c27ee3-89e5-412a-b6c2-0824cd2c2272", "value": "df1cddcc2f955315052bf7ce81aede5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104560, "uuid": "b9d009a9-a801-41c1-aea6-307acbebae46", "value": "98304:5c/VYNHIqPEgOf09gzaTBe7DFgiPW12xSSljnU2VIX5Je0bBCCk2:8YhWcjmA12PlLU22HdVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104560, "uuid": "4918c6e6-05f8-41e3-a3ce-9855564a99c6", "value": 4122656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104560, "uuid": "191704e8-46df-4f3f-baf9-d3fa9333d606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104560, "uuid": "3aab5bfe-f394-4afe-a27d-bff9c43636ce", "value": "cab1bf1949d73027e5c6ace9d2ca1934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24bc10b-cfb8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652115244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115244, "uuid": "23b834c3-76f9-46c7-a666-e81b78b87016", "comment": "Malware payload", "value": "2af53cc4cba65267e38bfec9d8d980be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115244, "uuid": "82870c18-7aaf-4aa8-b061-15aca0fdd713", "comment": "Malware payload", "value": "1bb3b0c525d125ff1b23702cdfa69718c7dcab936fa496e63dce0aa84b3c302e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115244, "uuid": "30a5dd50-5c43-4378-a7c8-000d86b391a9", "comment": "Malware payload", "value": "d0a63c097a71667dcad11e015120a1f6365a840a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115244, "uuid": "9b201782-0441-4e21-a3bd-7738fe3fc750", "comment": "Malware payload", "value": "e10959d3030bf255e7725e694a5c429b7da4bb99d86867768d16e2f000d76052301f8b098db1dd7d3c6ae67a07fca1f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115244, "uuid": "14a6ccb6-b6d4-44ad-ab69-4b33f86824d1", "value": "T123C4224C90A2873BEB7427F26994469113FB3D5E7071E2817EE233EE49227A41C55BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115244, "uuid": "17bffffa-04b4-43e7-83b8-5e1d179e71a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115244, "uuid": "32e26051-b3ae-4d76-a3b6-fe0815ca5608", "value": "12288:N/2L2IW2iN/2iNYFSLJVjhgnzQGMOFQWFff9Z5z/a0IvXCr7:N/2Y1J1iFWHfGLBFff9z/YvCr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652115244, "uuid": "8697a91d-9ba5-4902-b4e9-1da14124e41f", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652115244, "uuid": "8815a838-d1b4-4001-bcd4-bd09601aefe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115244, "uuid": "fae20935-e475-4672-88c0-47b40a041f0b", "value": "PO.001543666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51c17bb-cfa9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652108806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108806, "uuid": "13731012-a330-4a5a-bae6-6514490c7810", "comment": "Malware payload (RedLineStealer)", "value": "032b1af0dc259641f5437910074b5890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108806, "uuid": "cff7d886-2bdd-46c9-87ff-351c2c413f96", "comment": "Malware payload (RedLineStealer)", "value": "1c647caa2a98c985b7042dee428ade8615072a547cc1a805ebceb015ec680843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108806, "uuid": "f3a7aa0b-c41b-4057-8d06-49fba616dbe7", "comment": "Malware payload (RedLineStealer)", "value": "38bb16f3d35b6a39bcff85d9a81680113b41d1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108806, "uuid": "401e70a9-240e-4ee1-838e-90a39cd9c74d", "comment": "Malware payload (RedLineStealer)", "value": "daaff2e813a3cfe2e31bc205ae04a3c94a25c66b988056eeb34748d0c33ef9cedd24a5b088c3921d145fdb3d7b924957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108806, "uuid": "ba39aa27-20ee-4944-b2fb-0c6a0edeae48", "value": "T137557BA7C381511FF2673032C26DC676921637316A4F78ABB708ABECD72B1D15A25B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108806, "uuid": "889ea11f-e079-463a-9e03-aaae12eeea4e", "value": "95c60137b5c1bf3b2e377aefce384dee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108806, "uuid": "4dba5cee-d6b9-4012-9db2-521c545ca9e3", "value": "24576:zGnhRbEOlu0zOKUzhQHTPERO+wSCVVkKWLArK0+dfrZF7AYDTh7qRbbn2GOIogpQ:z6h/hUzSHTFfNsttg1OIogpjhDZEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652108806, "uuid": "a6cd8b91-5b2c-4874-9493-5483c2a9b393", "value": 1387560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652108806, "uuid": "529abb26-989f-41a9-b52b-ba69fe33d82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108806, "uuid": "c7b6e356-16a3-4312-bab5-05588c7e73d8", "value": "032b1af0dc259641f5437910074b5890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9382455-cf82-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652092117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092117, "uuid": "e6d0e864-0cbe-4318-8b16-88d54427db0a", "comment": "Malware payload (AgentTesla)", "value": "c2cf863e3ea0f8b9ebb2300d5ef8318d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092117, "uuid": "4bf2e7ec-c569-45b3-b26e-f14a333073a6", "comment": "Malware payload (AgentTesla)", "value": "1cf868e6621315d3c7875053b238ef81cfefa4c5befc0b3722b41f4087b00177", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092117, "uuid": "3f5e1e21-cf61-46e3-a3dc-d890ff05caf8", "comment": "Malware payload (AgentTesla)", "value": "b12ad091fd24372712f99da60473ef69152f1ad5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092117, "uuid": "97f95ec2-f55f-480f-9917-c1b007b1d256", "comment": "Malware payload (AgentTesla)", "value": "893a9968832c3c101328d6662ea6d34b4c85563422727817d68b7ccb03c585eb6871bfda79a39ad54b8417be78b707cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092117, "uuid": "7427a0db-db81-44d2-95bf-317d0c34b59c", "value": "T169E4220AA6D493E7E2B803F6A65152D007FA7D6EB431F7491D9532DF28B2B8A1500F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092117, "uuid": "33194ac8-f0a8-4ab4-bcef-970e71b9fb9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092117, "uuid": "caa31e80-51c0-4064-9c4a-ef436dd0c4b6", "value": "12288:CFF2L2I2c7pCYFydJrmGZ5TpBcFmcHaCi8MBj3DBHdgkT34jX6apOamr3cwx2:k2ztL4dAq59QDMVzB9gkr4jKapOa4Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652092117, "uuid": "7d07eca2-3997-426c-b92d-4b1b0e1b6121", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652092117, "uuid": "86e2dbba-0d28-48bf-83a3-58cac2c81f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092117, "uuid": "3ba4c254-01b7-4b78-8574-f2ac3d8110a0", "value": "Image00005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d578abc7-cfbe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117907, "uuid": "d8b23dec-d6c4-4d98-b8e9-bb3239794e2f", "comment": "Malware payload", "value": "254b000e3b949351c0df30c06a095aad", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117907, "uuid": "dbe7129f-a9df-4bd8-8061-c4e101563a29", "comment": "Malware payload", "value": "1d60193ad449d79ec065a734814865d60393ba7aabcc840f03e9460ff55b729e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117907, "uuid": "80a4dba3-89d2-4aa2-a9ff-d3f1a92f092d", "comment": "Malware payload", "value": "d64b47803ea68560170b0ba353dfc4182723f322", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117907, "uuid": "d00c9e5c-70d2-40c2-bc6d-1eea56098a00", "comment": "Malware payload", "value": "84692268c21f77b85d7e6d6de2ae27eed1e526ba06eac375c6b1ef8703e72795a0b873cb592c32f360679aeaf6214d90", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117907, "uuid": "d7438317-28ac-42ef-8d99-d22f427a929b", "value": "T13762BED38E35CB70F78771B84F52AD6BD85E1C396ED5E08321F70026FC2968909C5A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117907, "uuid": "32094857-9c98-4ce0-a0ad-86613e7ec80a", "value": "192:phV8czMOR8x1k9VDmEz0BsMIOOEVSNwbjJjX0/xXcCqAmaTH38Iv3:tR8xebcIbJ2bjNQuCqfaLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117907, "uuid": "d16062d1-2df7-475b-9d02-9cb58be16096", "value": 14696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117907, "uuid": "d3c636df-398e-4ed2-87a5-4c541fa8e70e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117907, "uuid": "04f4954f-14b3-4486-a808-527c96ce1902", "value": "KMOD.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e253b635-cf87-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652094306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094306, "uuid": "f07fb161-2670-4ce3-88e4-5dcf5820678b", "comment": "Malware payload (Formbook)", "value": "955a8204970399ba3fef15b77117a61c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094306, "uuid": "66f58612-28cc-4c0f-843b-dba3639ee441", "comment": "Malware payload (Formbook)", "value": "1deb03a5ecbc73c8d6dcbf9cf18e6c614be6b24ccd8f323f11fb97925db3b5a5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094306, "uuid": "d60afbaf-95b2-407f-85e2-4f5646670f1d", "comment": "Malware payload (Formbook)", "value": "4359ddf58d70a16788c2d1be756a6ebe843d7340", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094306, "uuid": "2d91b25b-699f-4668-820f-73f82648fc88", "comment": "Malware payload (Formbook)", "value": "6fd5d6da7bf8a73e8836c8f86ed408a88b6945a1ea0e504226d488b7403b2ead70aaab533da76cdecbb525dfdf161bb4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094306, "uuid": "f8f91488-c2cc-4afd-8c57-c7f19424c005", "value": "T11B8533EE7C58FF9F3792A1B0951876931295E0469D22DB2A082CE7BE11DED3142BC743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094306, "uuid": "b5a0136e-2130-4b3c-b25b-d65f8619f7d7", "value": "49152:2B3Cs5N/rzS9gqXNyoxb/wAEiLMjD9r5tKdR3bTbPh7hS:2B3CsjDOZzw/jxr5tQRHt7hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652094306, "uuid": "1881cba9-db38-42e7-8608-d110eeb51e45", "value": 1847299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652094306, "uuid": "407fac38-5c2f-49ec-9519-d6b1c3b9e354", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094306, "uuid": "1e4e0e1d-de3e-4775-9d12-961a6bbf3479", "value": "omar5.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220a2bab-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652104291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104291, "uuid": "81d0cfd0-403a-43f6-8639-11efcd858034", "comment": "Malware payload", "value": "fa1a36b58ae1a7a489cbec02c3bdfbfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104291, "uuid": "d7dd94a7-95d2-42b6-941b-840c77167f1a", "comment": "Malware payload", "value": "1f17bfed0bc27a7904bf150fae65504b987cfd04ebc2137bad2e18e6f07b2926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104291, "uuid": "a17f07d5-8ae3-4df3-a7d5-777876602a4c", "comment": "Malware payload", "value": "07f13b4a10c2fdcbb482b8062c4820d9d3509c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104291, "uuid": "569393de-4185-45ac-b06e-7f88fd30d418", "comment": "Malware payload", "value": "a97c543073d2ca8bac492c5842d19847aa02179917075ec554438838cda353acfeca97fd7df20fad5f7b4f6783ee5335", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104291, "uuid": "808e2b55-b23d-477e-b8b8-c2491a157549", "value": "T1887401AEAFC11716C092BC75D05EF2FC26D5BBC06B0EC02F8DAD7932C9B950255E152A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104291, "uuid": "652b26a4-52cb-429f-a005-fab58909b84d", "value": "885bb4e2e4aac617ada37d34ac7fe738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104291, "uuid": "ea6b9d11-05e0-449b-9c70-b7659cdac447", "value": "6144:ZVg7u09O+xsJU+s9zDI49AKyRkt51UZCqqQjmr9vVl6dTUmXQX:Lg59r9vIPzO563DdwmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104291, "uuid": "18ef41ac-c069-423f-8f81-815238dbf146", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104291, "uuid": "09ed3040-0bce-474a-a6ca-85547bdb0669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104291, "uuid": "a1a20bed-37da-4b17-bc38-a7669ce3f6b4", "value": "fa1a36b58ae1a7a489cbec02c3bdfbfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c715bdb7-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652058612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058612, "uuid": "0b00e2a4-54d3-488a-b48d-1c6f738ecb15", "comment": "Malware payload (Mirai)", "value": "09555f1c60a8c20e39631914a93e4592", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058612, "uuid": "8c57f581-7657-495b-b134-88dafdd3eab0", "comment": "Malware payload (Mirai)", "value": "1f300db9e90cece2c16749eb952edc4025b973918b679653f505721ed963fd62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058612, "uuid": "b583cb0d-1bcf-4186-aa67-ff0b57e612c1", "comment": "Malware payload (Mirai)", "value": "c337fa32a53abd3f9d0ba5ef861413a6df870072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058612, "uuid": "e52b2570-bee8-4d99-929c-9e52def2ae43", "comment": "Malware payload (Mirai)", "value": "68c6a52a49eebb3a1aa6962a6f69685e15806347aa35dee85e20e18941a12089dc3938a550265bc840e2a637f752b0f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058612, "uuid": "5ca9ba63-1681-4f5c-95c7-024fe42ded49", "value": "T1CF53970E3E21CFBCFBAC863547B74E219658339626E1C584E15CEA015E7070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058612, "uuid": "9b2790dc-32e3-49a1-91c8-057c314e9f62", "value": "1536:HeNYKsDua5/Ek/BTzUhI4/AvjdAaqH8TVq6yCXHhkhJ:+NYNDf/pUR/ABkH8TVqXCXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058612, "uuid": "a065ca3f-aec1-4bc4-b78e-4b8126a51f71", "value": 64620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058612, "uuid": "2e4f339c-d07e-4202-9ad7-dfd4ed310c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058612, "uuid": "e8164608-0e3b-4354-bfc7-011d8ec480d1", "value": "09555f1c60a8c20e39631914a93e4592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e2e0ca-cff2-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652140293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652140293, "uuid": "0e61798a-121b-4e3f-8e8c-d9da6238007c", "comment": "Malware payload (DCRat)", "value": "3697735faa344930d292bdc6d3cfef5b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652140293, "uuid": "c68922f4-b162-431e-adbb-11ccc145a40b", "comment": "Malware payload (DCRat)", "value": "20b7ee724ecb133ff2e1303b4f6f79b0b2d93f0fc3a6fd7df996119bc8d5dabe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652140293, "uuid": "30e2396a-edce-4969-917c-27048e88c096", "comment": "Malware payload (DCRat)", "value": "c355cf55f716d608c24d0de0db6731a7070dc1d2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652140293, "uuid": "363fe00f-a5fa-462c-a38f-1ce03fcfc79c", "comment": "Malware payload (DCRat)", "value": "4be940fe867aa4a3eefe713177ac52f1bb58ba10c834839c25aa05adfb55782e175eca00005248b84ee189514008eeeb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652140293, "uuid": "9494da39-ef5e-47e0-a86c-4211c6a0a28a", "value": "T119859E01BE44CE11F0991A33D3EF46444BB4AC502AA6E31B7DB9376D56223937D2DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652140293, "uuid": "1d1a178d-7d17-4c60-81c9-d63e31749348", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652140293, "uuid": "2f508d96-0cf8-4d81-8d1b-665b913574f2", "value": "24576:u2G/nvxW3WieCZkgoqTU1xron5B5cdG76/m6BWrMN9yve7rAD8ff6Q0FdY:ubA3jZkgopx4SvuA0m9G4rAAfy9Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652140293, "uuid": "2be4d6a9-3737-4302-aeb6-e2ba66505a54", "value": 1734788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652140293, "uuid": "aa994200-aa3b-4dda-887e-438d7763e5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652140293, "uuid": "c5617494-35e7-45e9-90d4-955e6afc02f5", "value": "3697735faa344930d292bdc6d3cfef5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96de338a-cf97-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652101051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101051, "uuid": "0a9368af-46bf-410d-8371-fe6b94be8ff5", "comment": "Malware payload (AgentTesla)", "value": "163f04b50f0856aa0915dec9caf3342a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101051, "uuid": "7ade349c-7b2c-4731-a667-bc3ff3ad75c1", "comment": "Malware payload (AgentTesla)", "value": "20cc191fb3b6c7a6be027679fce6e991bb7bcc7c54fa131c15c1dc022c4bda53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101051, "uuid": "4168e4e9-74d3-4920-98b5-14402f124d27", "comment": "Malware payload (AgentTesla)", "value": "745eb48039b2d86282169e75b95fbefb1dec88f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101051, "uuid": "4291a6ee-2d7f-4758-aceb-33008aa6397c", "comment": "Malware payload (AgentTesla)", "value": "fd7d7c9836844f074fefd02438676706a149f6e0353a972bc361b18f5af8438988092f76c773ce7976dc6ae912e14324", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101051, "uuid": "4cbdb818-c5eb-42b8-a5cc-2e9471eba6e3", "value": "T175E4230021AB5777D3B873FA546913C42BB12E9DF553F68AFC7111FC299369A0202FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101051, "uuid": "4330b2d6-ba78-482f-a271-71dd1d554d5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101051, "uuid": "13364d2a-5af2-48ad-9828-527727aa66af", "value": "12288:wdgJK+e23bUkeBFzmFV+S1/tB5teGtUQpLUU3LaWb2L2I:T3/AkeBRw+C/nea7pdNb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652101051, "uuid": "0cb91d36-5a98-480f-b7f4-94ab7428b755", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652101051, "uuid": "a7ed3b08-f686-46ca-97cb-d75af87d4994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101051, "uuid": "b84853fe-8984-4a34-846a-0e819cd6ccc9", "value": "BD4uoKLzGeTFTEH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b667d72-cf7d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652089651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089651, "uuid": "80d464c7-97a8-4053-a54a-d576b2b579a2", "comment": "Malware payload", "value": "867522320cbddadf01efc10625c4fa95", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089651, "uuid": "a75abfe6-de2e-4397-b372-77fe0b31f8b4", "comment": "Malware payload", "value": "213c3b35854c2fdb471eb8c86ca2428fbd57c402fc058c0099d8cc75c6984d33", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089651, "uuid": "336b4b7b-91cd-4cf3-8925-7456c240246d", "comment": "Malware payload", "value": "a5912885254ce42e7b64266c7f69dcd61478c846", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089651, "uuid": "31182918-ef45-444c-bfcf-27fa97b8719a", "comment": "Malware payload", "value": "299181dfb762ca95fee68803a7d1c515deb1b22bfaaa900c6d6bf920dd44857e96a83c8f246badf26ab12efb2b1362f5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089651, "uuid": "4c674be0-3bac-419e-8409-167e1ce76d1f", "value": "T1EAA5F142F786A86EEDF3C33E473A465A61128D598743DB438A64713C1DBB9C0CE96EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089651, "uuid": "91933f03-4565-430a-b873-d7f30d38a66f", "value": "49152:rYrRR2NpDoHXPDOe2p/hv4fLHq67uo7h6/urIoC7W3+r:rURqoHXPDl2p/wHqc7h6AC7W3+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089651, "uuid": "4f3339e5-abfb-4079-aa06-733046b75e90", "value": 2267329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089651, "uuid": "bfa6ef12-ffbd-438a-96af-e537b5a04902", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089651, "uuid": "21362ae8-88b9-4b7d-9bc7-1216c7831fad", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0082c93e-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652104665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104665, "uuid": "79eaab18-041a-4bca-b0b5-580e91eb9cb6", "comment": "Malware payload", "value": "2af55195270567a474d337b35d643dbc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104665, "uuid": "b9925c2f-ac61-4c83-9a81-8e33d5b5f1f4", "comment": "Malware payload", "value": "21640bb816ddcd2ac0cbea9dcdab3e818e235c99e53bf090dc9e5cdda6c2ca92", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104665, "uuid": "193d6bca-54ca-46b6-9a6f-9f5f70de9510", "comment": "Malware payload", "value": "e701830a0e786cada24163f0a1748cff7865f748", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104665, "uuid": "587c94b3-9c09-4e12-a1bd-b926151781ea", "comment": "Malware payload", "value": "383a1403690b197845b92c861b6fcfde80d4dba481e9ee06a2b549021f17495be15e0f8dd0b4f34e27f0654f1d149ea7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104665, "uuid": "9513ad40-cc7e-4d99-95f7-06c181a0e880", "value": "T104E56C23F384A63EC56F1A3A5537A3549D3FBA6165229C1B1BF44C8C8F364812B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104665, "uuid": "8438d1f2-4494-493c-aadb-dd0bb721a25d", "value": "49152:UNBw7/M9/nP2pYSUNbWY2HlfAptqEja5KlkTTOOYLEA:dGne0t8UljOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104665, "uuid": "2594c5d0-5ab0-45b1-a3b8-f9e80874d9e6", "value": 3252224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104665, "uuid": "827406ba-4e60-4070-b046-552578103605", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104665, "uuid": "8034f125-9ef1-4888-9c33-b5f9087374e9", "value": "Ac.EndesFactFecha0805.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c93bb92-cf8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652097491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097491, "uuid": "60b106ec-b548-4a0a-8de6-8ff993aa9557", "comment": "Malware payload (SnakeKeylogger)", "value": "72091a290127372f12c642c809a85a15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097491, "uuid": "f5cb12aa-2664-48b3-9437-cd3a8b0bd615", "comment": "Malware payload (SnakeKeylogger)", "value": "21aff4553303a68d7192ae845f8db741d477c6d59f8ea04f15172e24c6f100dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097491, "uuid": "4b0b513f-47cf-4ff8-b77b-f0573e179c53", "comment": "Malware payload (SnakeKeylogger)", "value": "d52248a9543b53c57a9f2dd65044cd8fbfcc81b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097491, "uuid": "ca978573-95d8-43b5-a217-50f03cb1cc73", "comment": "Malware payload (SnakeKeylogger)", "value": "c8fafcd4b9acde14518c4416fb418a450f39710bb3dca24a0301ff4cc1c05abfd38c1674fbbf5eadd71731726b382e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097491, "uuid": "2ead75dd-4f26-4105-9a36-83e23bc7f2d7", "value": "T11FC41226ABE98B3BE77E43F45501930563F6262C7932F7883CD524DE54BBB842240E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097491, "uuid": "b78df821-b9fe-4fdd-bc9f-0556a2e8051d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097491, "uuid": "e3551e39-b53b-4332-b8ef-946632b7816e", "value": "12288:32v2L2Iymlp7wUGVjXrpZHWl/PFljMTPKSQejYvBN:k2xdEB7W1PsTDXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652097491, "uuid": "9717164c-72b6-48ca-8556-bb1cdccb1284", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652097491, "uuid": "dfcda732-a9f7-4f6d-b0cf-1e8040f4ba06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097491, "uuid": "399d1742-8b8f-40d4-ac2a-f998a3dd9be3", "value": "20220509_77388366747636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13b4b8b-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105418, "uuid": "595d9649-11a4-47f9-881a-91b8e2cf53ac", "comment": "Malware payload", "value": "09933c0880557096f6454686378d9691", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105418, "uuid": "499b4f15-f874-417f-907d-ffa33e7f109a", "comment": "Malware payload", "value": "21e514f48f1960965cd8c97ea6144e3ae529ba7c19d6547d64e75a927374ce80", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105418, "uuid": "318a2eea-b9fc-452f-800f-93842ea2df46", "comment": "Malware payload", "value": "5ec1e6e8c53943c77c5c4024d52e78a2cc052574", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105418, "uuid": "9ba6d7f6-2631-4a77-bde1-44bfed5a93bc", "comment": "Malware payload", "value": "7b34a0815e09344fe547a7b7679febd05441e244860d20433a19fd21fc0218f7ba85635ae983c9cffb856969d1673d1e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105418, "uuid": "5a2077ca-eec8-42a5-aa2e-44f2833b3a9c", "value": "T11D347C227444803EE7FA1A32993ED661AE7DFE240B60C95E8384BD0E5D704D067F7B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105418, "uuid": "3917bf9a-d8bc-4bd7-982a-512c20842615", "value": "3072:C9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDOwqQ+cxbkRqMGY:CuH2aCGw1ST1wrL5qvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105418, "uuid": "738705d8-9f90-441f-a1dc-b6dbf53a17a8", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105418, "uuid": "61ba2f69-3f4a-4471-909c-47ad0407c475", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105418, "uuid": "dc3de4d7-2a83-4337-b250-a26e13540f0b", "value": "Protocol_546979_Wireting_t_PsF_XRTTL\u00ae_sib.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d810bf-cf7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652090747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090747, "uuid": "6c536458-5962-47ad-91a7-dbfe58c58374", "comment": "Malware payload (Mirai)", "value": "a30147ec185e62108fc84f21a37dd170", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090747, "uuid": "280b4a06-6592-466f-9e0c-571410ce7c70", "comment": "Malware payload (Mirai)", "value": "22270e5510222977f8afc4f79957219fb07ad55f8c0772aa498a0f30ba2c0d52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090747, "uuid": "422675c9-78f6-4ae4-852b-147f41413d08", "comment": "Malware payload (Mirai)", "value": "e54744663b1a1db6a48f197608fb6c67acc2ea58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090747, "uuid": "e691ec43-2290-4bd0-9e7d-4cd896cf0c1e", "comment": "Malware payload (Mirai)", "value": "0087582bb8dba4b99e42b379ee865c666fecccccee468680df2d5f8b40f2dfee57bb5eb6b1a7024f31c4d17a89dea45e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090747, "uuid": "6bde2920-4239-40a6-9f0e-18e8e785248f", "value": "T14F634C01725C0E47E1A31EF5253F27E193FEE99020E5FA89650FDB864231E37468AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090747, "uuid": "f46e866f-a22f-4773-9c92-271e58936452", "value": "768:sKcL8O4n1eRtPJf61jNfRhkGMkRaydnJhvDyqw7niYSn3fF9S5gzSTgC25HqGZ4k:O4Sj61LwoBwGjSuGA5KGKZZuci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090747, "uuid": "5df87177-39d1-448f-b0aa-7fd5fa1b0002", "value": 70888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090747, "uuid": "2adf99db-febc-4fe6-9f07-b086c8c95579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090747, "uuid": "4481c6b9-7872-406c-960b-6a0c01d774fe", "value": "a30147ec185e62108fc84f21a37dd170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f887d12-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652105307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105307, "uuid": "99484a25-2bec-40e8-86a5-948934470203", "comment": "Malware payload (GuLoader)", "value": "c494a7c2606aebb75ed058a495e284f5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105307, "uuid": "3dbe870a-07a3-483d-a120-919a8253e44e", "comment": "Malware payload (GuLoader)", "value": "22cf942a449bfb8a406172f07842e83e2ebb509fa94a4ec81aa4f70b694e56ce", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105307, "uuid": "95b349f3-b7b7-4363-b8bb-0c360eefc5bd", "comment": "Malware payload (GuLoader)", "value": "fe7f1f45f498e8fb396c4b234ee567612743a3bf", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105307, "uuid": "12cf95d2-2387-4041-9b9c-751c44aa05b8", "comment": "Malware payload (GuLoader)", "value": "d84388051c008772d43ef615eb603d052b5c9b364dae311ca1ee197735fb33000e0f426ca0addab1bd6c2de0f500f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105307, "uuid": "36b37a35-29b3-4064-a218-2cea6ae381f5", "value": "T17534FBC0622C1ADA9258E19CFCD131561F47948EFA27E95EA3A00F2F4351613BDCDE6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105307, "uuid": "687f6b76-a449-480b-9c11-34fbcd51dce3", "value": "3072:6KEKEeCKwpuju9EApdJGmUBBf8+rXSrk1GKj4MIC1W4/KJGxkjp:9E9KS93fjpEcPC1LKJGxkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105307, "uuid": "65355f63-327d-4c53-9890-9bf7ce080b4a", "value": 234417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105307, "uuid": "112f0796-00a6-4412-aa0b-a07e93c5861e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105307, "uuid": "ae14b476-0041-4ef6-a160-a11e805a817f", "value": "annoncere.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b5765e-cf89-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652095070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095070, "uuid": "36849e29-9d50-467c-b0a3-f5fadae7389a", "comment": "Malware payload", "value": "5463fc1ed75f6cac3da5e55fe6578129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095070, "uuid": "311fec8f-e8ec-4cff-92bd-6fe8541d01d0", "comment": "Malware payload", "value": "22dec08366ceb4caa1a0b1b5a421615271862605cdb5120d679bd8662196127d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095070, "uuid": "a80ea4b0-e446-435a-9a90-8f6a72ece651", "comment": "Malware payload", "value": "36fdea5d4b10b750bf426679ac3ab9a79b60b9c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095070, "uuid": "c5b2a190-7c5c-403c-bdd9-957c159b47ef", "comment": "Malware payload", "value": "1458ca424771ac5a74e079e79c79c2f876736fadf73cd703b311cc38c90bf3836915b0268360513ba6262eea910f759d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095070, "uuid": "a7356bd0-4a42-403e-9367-6700b8d494d1", "value": "T13CB37D251ADF5D4AC1923B7E49E1E33861E6CED0352BDA12CAF1BE07FD25784AE851C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095070, "uuid": "d18e2cb7-b4d9-4cda-b316-77adeb34b558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095070, "uuid": "91d4b281-c8b4-45b2-b333-246667d34a37", "value": "1536:+Ez7DeiBeEYgpRv20Cki/+DQrp44XdpvPEHrOlDZ0dBBRs+pqIGLUkd1:DzOGY2vVD8p//vPEKlCFRs+pqIlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095070, "uuid": "6fe3fc0b-af2c-48c0-b27d-d4a41ba43397", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095070, "uuid": "1ed90afa-17a9-41f8-abd5-1e5f36473edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095070, "uuid": "3fb25de0-4b09-4635-a53a-e6fd6ada7e25", "value": "swift transfer_20-04-22.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f70c492-cf7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652089013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089013, "uuid": "97ee0707-9c94-4ec7-ab59-01b740820760", "comment": "Malware payload (AveMariaRAT)", "value": "b047daf546fe1157a453c87e665299a2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089013, "uuid": "1ad945ff-859c-48f7-ab31-3d8b75fd2322", "comment": "Malware payload (AveMariaRAT)", "value": "22e284d1d1f0942467d83cdf4e4806e48c3356f228c548e3cf39f1c14544fa89", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089013, "uuid": "2263681a-2e82-4611-a5d8-95385da7a9e4", "comment": "Malware payload (AveMariaRAT)", "value": "ba83410d522f6e877e5112a71c130e67c02fad89", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089013, "uuid": "e180c124-40b6-4bad-8f43-5e204fb3a7cc", "comment": "Malware payload (AveMariaRAT)", "value": "0e9d3365c5a345e7e03a590cafedfcf30e9c4ffa580892bf70347958b1b77bac4a662535362c4c417fb8d740222de4ba", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089013, "uuid": "db53d125-4951-48e1-8227-4b17aa7dd89d", "value": "T1B3A4AE9D752071DEC86BC0729EA8DC78AA556C7B430B011391E72DAFFA6C897DF140B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089013, "uuid": "a459a5a9-575f-4d82-8c8d-fb5ed7a240db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089013, "uuid": "14ed00bf-072c-43f4-9601-55da31377062", "value": "12288:bLHvQpr7wydxzYVZ9J9dKPC93A657lo4JSQg2e:HH4pAKJYVZ9J9dhw6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089013, "uuid": "d421fec5-3a09-4f99-a0ea-d2807abd967f", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089013, "uuid": "254ade1c-865b-4f46-9dec-a811660689fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089013, "uuid": "c02432e0-dc85-4045-94d1-5e419aeb1132", "value": "SecuriteInfo.com.Variant.MSILHeracles.37619.30455.27883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa3a39a-cf7e-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652090481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090481, "uuid": "d5fd6847-2bd9-4de7-9c31-d8f3a16e43e3", "comment": "Malware payload (DCRat)", "value": "0ff4e6fcba9c3f1a9ca500eac3c6fc2e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090481, "uuid": "61dd6a33-889d-42f6-b3b0-0b5fb05a7b9c", "comment": "Malware payload (DCRat)", "value": "22e970fb473df1a8fbab3001846f113f24fe3efbb74cdd46df9c46823c49c5e2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090481, "uuid": "e4a8ae56-0980-480e-b0da-30a396d0b795", "comment": "Malware payload (DCRat)", "value": "50c2812c225662bf98fc7825f92e8c41238eaeb6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090481, "uuid": "0d27a6fe-9f15-4f53-a0ed-3c4a069394dd", "comment": "Malware payload (DCRat)", "value": "55ef656dfbc24bcf7b3ea1e4559bf6c0664b6b6c224d9185edaef923694f87c086204bf203b7dad4f2e401f77d1f2646", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090481, "uuid": "a475b968-91d1-43db-a84a-65e0f497e2ba", "value": "T1143538027E448A12F0141633D2FF594483A4ED412AAAE31B7DBB7BAE15117E77C0E9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090481, "uuid": "b5401e78-d7ad-48af-b960-742f69c0c1cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090481, "uuid": "bd9352d9-0343-4a7e-93cd-1f84b4349234", "value": "12288:zQpqRO6YAcHsnOIT+QeIYFauxgFy0DYvxwe1osM6yB19ESZin35u8W/Zer1yczva:zanAoGvZQFUl631oswZ2y0rUczvdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090481, "uuid": "6141ad53-f187-451f-b34c-2b3091f0a511", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090481, "uuid": "d67536bc-d1c9-4758-b01e-0bdfe45fabb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090481, "uuid": "30a39ead-c9ea-46a7-93c8-e3670c1f076a", "value": "0ff4e6fcba9c3f1a9ca500eac3c6fc2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8db07f-cfd1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652126000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126000, "uuid": "8e3a3da4-cc43-42f4-93a0-a285c797248b", "comment": "Malware payload", "value": "09fdb7c83a40f30ca6de45ff929e9b0b", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126000, "uuid": "b2007a15-031c-472f-95d7-77351be2d3ca", "comment": "Malware payload", "value": "241297056eb84f7c24c697e248501ba8c4a22bc32a9da212616617f945a9b133", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126000, "uuid": "eb42f3c1-ca39-4c41-91a8-71c06014324b", "comment": "Malware payload", "value": "750e285dd710f4968d2df57233d83b45545158bf", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126000, "uuid": "d470b58c-04ea-40ef-b968-dc7c3dfd9cae", "comment": "Malware payload", "value": "c0f1f1f5321fc272814c61606c1de1c16737fbdc7fae11029585857b1b12c1b66313e2a0fdb67c85e64d147f1b715c67", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126000, "uuid": "b1ee497d-c16b-4ecc-91fa-58399a1de445", "value": "T1EA75236ACD378FF752B9B8E845705553C8A88DD1A1710A47E100CB1DE6C29BB6E902FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126000, "uuid": "f18657f3-c4b7-46ca-a452-de487fef36ea", "value": "49152:MfqWMulLUMyJ1OQvrdxomPk5e9kO5VOyShwI:MlMulLUMCgQvpvkM5cNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126000, "uuid": "63840965-89ba-41cb-87aa-a0765da8925f", "value": 1687040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126000, "uuid": "13938d83-33bb-4fef-82a8-ff86770cc184", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126000, "uuid": "dc5cae3e-f805-491d-a57e-c761e40d6377", "value": "bitrat.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60aff1ad-cfbe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117711, "uuid": "10eacfbe-a564-4908-b2b8-5346f1a0d12d", "comment": "Malware payload", "value": "9ef13647102e4284c30a7e3d3e2227c0", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117711, "uuid": "66e993bb-3b5c-4a8a-9d49-5157cfd2811b", "comment": "Malware payload", "value": "2457a1b0008c7059b5d58fffadad4e71f8332e9c09ac55f34b0a078363c29c87", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117711, "uuid": "1f055a10-63fd-4afc-8964-72f9e60acbb4", "comment": "Malware payload", "value": "36709e87fa7a99589253b45d842470315a67e2ca", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117711, "uuid": "0697ffd6-c500-49c1-827f-ea8968290b0d", "comment": "Malware payload", "value": "2436a1ab8165f8eb61e15ecd7a11ff3333d7895d7435ab096dcb3fb7e7d169919691a1fda23383014b36616104c79786", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117711, "uuid": "89a7fe44-403f-4ee9-9208-fcb88b647f96", "value": "T1A2556CF95F99244C983BE8199497BC7E9B8835135B4EAFD03717E9126376308A82C1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117711, "uuid": "319be095-b76a-4ea5-936b-21fce50d20ea", "value": "66356a654249c4824378b1a70e7cc1e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117711, "uuid": "01c07b0d-20f6-433d-bdec-ccfa989ed9fe", "value": "24576:waBf87gheqqqguvaURKZX7FvqJ3eWrcQmS0FMnRWN3FctRdTaEg7v7mIPb9XJzb:gYaeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117711, "uuid": "d34b021f-dc47-44f7-93eb-c3ca4223ef22", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117711, "uuid": "0a09b4a1-de4d-4186-a5ce-ea27ac7301b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117711, "uuid": "49898a6d-96e2-426b-ac60-63e94172d58c", "value": "oblot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1376805e-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104267, "uuid": "40c1ed74-dd6b-4841-bb42-171b4e1073a0", "comment": "Malware payload (SnakeKeylogger)", "value": "23f88a98ef3c600d321a14c86b0ef9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104267, "uuid": "89930876-f687-49a1-85fe-d3c389572e85", "comment": "Malware payload (SnakeKeylogger)", "value": "258e5e24afe8c4aa3b1afef9be3ec8b10b32b64f02fa2befe01b39c9e82edd2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104267, "uuid": "fde15918-fafb-4f96-8bf7-fd9fed385de6", "comment": "Malware payload (SnakeKeylogger)", "value": "3c9666c2a913e59bd00cb8e2c52fa04240256158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104267, "uuid": "50137e34-953d-4dff-bfa3-bfe5fadf7899", "comment": "Malware payload (SnakeKeylogger)", "value": "fafbd1fdb714a5746dbf209fbc2ee86b4b5930f9b9e867d2d87ac880b53d5f0c019a583aefb4e2a0bf931ea4e9cf8b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104267, "uuid": "425e53a4-9d0c-4c89-8cdd-a98364ce83be", "value": "T1B4738E777E94F6AFD6BE05B32B82C280331C7EBE84A0D15DF344723694E116249B6AD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104267, "uuid": "4b891b67-9394-4c2f-9555-dc569c1e231b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104267, "uuid": "62051656-829c-4c8d-be4d-491c9d22596d", "value": "384:HWwSjDpPdURg8u6mr7toowsfWP8Nc8WQ1qLbEKBKpEO3GUL5SPeD9WimW:HW3AG30PV8T1KbJwpfGUNseL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104267, "uuid": "d7be51b8-1250-4f02-ad37-6bbb4277fca7", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104267, "uuid": "b723171f-4a45-46e4-b7e6-4374c07a5755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104267, "uuid": "331fb769-c6b1-41df-a88b-f9e2b465334b", "value": "23f88a98ef3c600d321a14c86b0ef9f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7792d288-cfc0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652118608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "d082c989-6c3e-4e70-b934-7938b05bebae", "comment": "Malware payload", "value": "1a6b20230701fec81675c9d1ec4b27c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "39e8a1f3-94bc-4326-b622-9fb591a549d8", "comment": "Malware payload", "value": "2675217dd3439b9e1580c4245633adbf00b39b990c025b88152cef854d4ffc35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "8cc670c9-817b-4e5f-a33e-814ad5336d6c", "comment": "Malware payload", "value": "fa9c6a5e94fedb49aa83b0ebfdc25558ff641c21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "910d0924-6447-42f6-9ef9-2ee063181c38", "comment": "Malware payload", "value": "60ffb217cc7cfb18e48146a5b942c1ad425e14a7613ddee7a5f486a41f4a4e0fd2ec23cdec3075c1ced04676498a6711", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "7eeda335-c4c4-4b5e-9ee6-0226c50742c4", "value": "T181634C46EAD7F9F0CC450AB8205BAF75D836A8333130DFEBEBD8B9179956342605225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "72b8244c-ccbb-403d-ad37-054f623dcabe", "value": "1536:IeAolofbYYQsBehM1XcB3xuSOUd3dgg8SbmrmG:IeyssLcBJDXbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118608, "uuid": "3478a475-0b18-447d-9acf-050ddad01673", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118608, "uuid": "596ba44d-d937-4ef4-8ad0-096401284292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "5fd4f9cb-fcfe-4853-9128-f292697bd460", "value": "1isequal9.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6cb2f1-cfef-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652139018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139018, "uuid": "8ac42068-7d43-4115-ad4a-d25e8016a314", "comment": "Malware payload", "value": "38ea4397f1c9dfe79e9accaebe7487ec", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139018, "uuid": "7e6051d7-1d8a-4b6e-8480-27c0a0c9ef32", "comment": "Malware payload", "value": "281a1cfaebf968012e9596721d14b1bd6429744617e73f96558cb68bcc0db8f8", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139018, "uuid": "960c2412-2cc3-4e83-afb2-623ef7389780", "comment": "Malware payload", "value": "24614b49e47bbdc30263cc86cea8aceb2781f1ed", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139018, "uuid": "dcddcf6e-08fa-4a34-ab88-cfb1beae176c", "comment": "Malware payload", "value": "44dcbddb2510f278b7bde3ffbd846e46207388d53f9b98bd6892f6f517b1bacd50a6a6dabf74221627a2304b9f0c9248", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139018, "uuid": "5226760b-22eb-4bc1-adee-fe8f6f6719fe", "value": "T196556DF85F99284CD83BD8199497BD7E9B8834535B1EAFD03717E8122276308A92D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139018, "uuid": "c63df56d-fa97-433a-b23e-58a8b766a2af", "value": "66356a654249c4824378b1a70e7cc1e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139018, "uuid": "974d026d-7aa9-4f50-984c-175ba1c0de70", "value": "24576:Qz868Rnacmr8Oojv03br/YXYugvutZooFS7i2xyyIRfbi8mskmWcJc3mm7tnAgHi:Y86twnv/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652139018, "uuid": "89d2fd14-7807-4dcc-aabc-2ebc50028e31", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652139018, "uuid": "ebc5b0bb-5f92-4244-adff-105238c0d97d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139018, "uuid": "1228d964-b751-4400-9026-25e345877875", "value": "oblot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfaa7772-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652105012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105012, "uuid": "8a4bf721-81fc-4684-9616-6569034ef3bb", "comment": "Malware payload (AgentTesla)", "value": "fd415a2d9451cc1390300474aadf1b11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105012, "uuid": "373c4ac8-8c04-41ca-a144-b518464d4a84", "comment": "Malware payload (AgentTesla)", "value": "293e694edf846d3318a40d81517209e0ce12bb90cc6fb033cf2b2b0f3d5b3e26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105012, "uuid": "d0be965d-895d-4acb-8872-93ab5cc4e158", "comment": "Malware payload (AgentTesla)", "value": "8c1e45322587450b8e95884a1f95a2350eb8918e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105012, "uuid": "027e1cf0-1862-4946-976c-a88e76f3d211", "comment": "Malware payload (AgentTesla)", "value": "77fe8bbd2239fa5b4c517690a4a1c25ad9f6c810c496d4a81337de5570ed3a9102775edbb4b15861ee2f00745fd0c771", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105012, "uuid": "fcf81926-b8ca-4679-8f31-baa4db1ed6b9", "value": "T1552412143D2E58E2F0820C3F28B9486BEA7BDDD8191DCD690599FADE73B78684113E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105012, "uuid": "ebcdf05d-7bc1-4ff8-91e5-92ef7d0bff62", "value": "3072:qxs1T6BiItHppSRyqIR4ZKlXD1kcbDx93YU0RF5Kh7qrZ01LiDc51+4TKZ:rJutPM46ZaiSDKRLcWIIc5T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105012, "uuid": "bcd4bda0-fad1-4633-b391-ab2105e78c6b", "value": 213752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105012, "uuid": "f981c4ac-c9ca-4be7-9253-a7e0431d2703", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105012, "uuid": "6a81790b-1816-4377-972d-526085de1ee2", "value": "WBC info.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa77a44-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130943, "uuid": "9f612789-5b51-470d-b42f-de475cd7e294", "comment": "Malware payload (Mirai)", "value": "27454d780db6d8e512d96583d0b21a21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130943, "uuid": "4f9adcc0-2665-40e5-9f3c-c4c3e41b0542", "comment": "Malware payload (Mirai)", "value": "2aca29a4434dc41c65abce7c6b990f248a199bc2b4d2a7779fbc37d9e6cee09c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130943, "uuid": "b00d6ebe-4d23-41b0-896a-d79a823d7f08", "comment": "Malware payload (Mirai)", "value": "ebe4425d791757248d31780d32763600d9878fc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130943, "uuid": "e1b4b3b2-b9a0-4384-9b68-0892f3085d15", "comment": "Malware payload (Mirai)", "value": "32604eb9e2f4aafc788196fb7744b313ac8ed23a91fd4f8b05cc9fed4ccabff4c793281409effce7a665d79b4bb8e624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130943, "uuid": "bc8a2290-3dd5-4647-9916-1d3fc4e39bb7", "value": "T17F535CD9B4119E7CF9CBEABE88224E0DF860221154930B27BAB7FD937D32195DC52D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130943, "uuid": "8f81b1f8-03d1-43ea-a3a0-f11c314394b1", "value": "1536:j0klfwJ/mebn9ykMBR7l88g1pkPwtF5LR5kSF/zlgs178j:j29168xpZXlR5VgyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130943, "uuid": "e1b82fe8-09d8-4ff1-ab01-8be9c5b11d92", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130943, "uuid": "fa4cc44b-34d0-454a-ba42-35233fef5ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130943, "uuid": "9cc15d1e-8148-4337-a683-927557347861", "value": "27454d780db6d8e512d96583d0b21a21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb67746-cfab-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652109814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109814, "uuid": "9025cda4-a320-4e27-a5db-1815d22b5e47", "comment": "Malware payload", "value": "3a8f95a7b5cfa9a81161496955711f79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109814, "uuid": "3bc53106-75d2-4f34-87d7-4489f5b0d35b", "comment": "Malware payload", "value": "2b338762865068862ab731f9c18fb8ecbf81571235366b6bd29e9a6c010a6d7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109814, "uuid": "987c7317-0da3-4d24-af42-ac6e0a771ae3", "comment": "Malware payload", "value": "dc2fb3f8006eabb971b425eacfd623934f00f48f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109814, "uuid": "a4448040-49b6-463c-aee7-29bb858c77e9", "comment": "Malware payload", "value": "e5979c8bda5fa6bc933ad4ec86b8d32cc1f127a26dc8cec33f47c74505cbdf97040a00227623bdecc9f6b6342e0461b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109814, "uuid": "62eecedd-8f1e-4aad-99db-1c2a73552b98", "value": "T18A3412045A62D4A7D5620B30096F9B3B5FF662335560433B6B60A3AE7F216C3CA1F7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109814, "uuid": "95f62c3e-77e7-4d5f-b26f-a1686d4ae0db", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109814, "uuid": "e028d838-2e88-46bb-8145-eae09923c185", "value": "6144:HNeZmpFLQufW+j2xhBGikDv6Fv3Rq+zJNw0//7gG0L:HNlpJQufjzDvUv3RV3VLgG0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109814, "uuid": "6002334c-e630-4c87-8d9d-46b0eaab79dd", "value": 234449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109814, "uuid": "9b2e0566-75e0-4c18-935d-e9a4accdc8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109814, "uuid": "cc43a988-d468-40c5-b055-6f94636d17b7", "value": "3a8f95a7b5cfa9a81161496955711f79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ddc919-cf6a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652081511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081511, "uuid": "af3971f0-d18a-4df6-9d70-ac053dc061fc", "comment": "Malware payload (SnakeKeylogger)", "value": "96afeb5862d83bfaa3cbc1a79cceb536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081511, "uuid": "e0a58f1b-92f2-44d6-bdbb-009159391dc5", "comment": "Malware payload (SnakeKeylogger)", "value": "2b59c03cc1ba926c9c8ad273cbf69922ab21c1d9cd545d2ad4e2d0a33530e701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081511, "uuid": "75dd7168-2483-4103-993b-f7d89f2498cd", "comment": "Malware payload (SnakeKeylogger)", "value": "3f6753976a0b019b49ec0aaead3e25eacb00a492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081511, "uuid": "f5142431-0111-446f-b81f-dcbe2aa11986", "comment": "Malware payload (SnakeKeylogger)", "value": "c8428b2657db8f988d84d25760b07dffccbb8d34ddfa486c2fe045526fa5d8613d047154734ef1c2c1111093c56bf0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081511, "uuid": "94416b3e-b61a-4c15-b843-b80abf757ab2", "value": "T1E7A4389CB12071DEF85BD472C9682C64A691776B430F42039833E3AA9E6D5F3CE55CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081511, "uuid": "c21528a0-248c-449f-97f1-291abbda71bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081511, "uuid": "ceaf393e-eabf-4130-a3e6-a3c3a231de2a", "value": "12288:wgjjHvq+p1fH6E2dRpsrCu6JGbYTspUoEWwwNuVA9aJ6m:wgjjPqKxaEsoCHJGbMsp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652081511, "uuid": "5418b4e6-6866-45b5-a0b5-18ec3e3537d3", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652081511, "uuid": "8ed2f5be-ba0e-49b4-8471-80ac76eb01c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081511, "uuid": "922632d5-796b-4488-842b-dcc316b9ea7e", "value": "ALBA FOOD - Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe08c325-cfe1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652133007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133007, "uuid": "42cf42e9-937e-4a20-900a-82a9720e4677", "comment": "Malware payload (Mirai)", "value": "2806c54c2c6c0fd6669d1428f7a73b81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133007, "uuid": "bab624cb-6b1d-4585-a5b6-69cf28c3ff78", "comment": "Malware payload (Mirai)", "value": "2b6bab37bdd7d8af99c18c1568ddcecf13122926d66017825584de67a606835e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133007, "uuid": "290ef780-1fe5-49a8-8f88-282f95566f46", "comment": "Malware payload (Mirai)", "value": "960ff2ccb41174c531672affdfc50d7f361ca257", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133007, "uuid": "101e7592-f658-4df3-9518-cf81540ad9f3", "comment": "Malware payload (Mirai)", "value": "c692d3686a412bc3a8617764d9c968088dddb254fde6f788114d1e3a35b39f894ed983f0ed4489dbe14720a9d99aaac1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133007, "uuid": "a28cf40d-e5d3-44d8-bf87-745c118c5a1d", "value": "T1FA832981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03A9F95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133007, "uuid": "f9b4cea3-aedf-4391-bcb5-9f5873e8e15c", "value": "1536:NySHwrZKkRozEsK3sU33eZtU5SWmZPeTriW/SnvL:NySQ9Kog83w9ZPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652133007, "uuid": "6ea06c05-df9c-4dfe-8f46-5d7333b45690", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652133007, "uuid": "f52085e6-dee4-4691-bf07-3849d939ec25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133007, "uuid": "7d78306a-c3ee-41da-aa43-e9152915cbc3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49588c8-cfd1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652126012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126012, "uuid": "e166fdbb-63fc-4919-8244-69150d0b86d3", "comment": "Malware payload (AgentTesla)", "value": "ce2f08719660d9a108962859a6ad9ce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126012, "uuid": "04268ec4-9fda-48f9-a9b1-6c100d84d385", "comment": "Malware payload (AgentTesla)", "value": "2cc48aed2dfa32f09cbf9d1bf902ab7b3c2b26f7aea686fc60326232b32f7d26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126012, "uuid": "afad3849-c75e-4291-8076-5c2f96cbf6fa", "comment": "Malware payload (AgentTesla)", "value": "8f6b91f325919ef219335209ceaf8f2f13805ad8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126012, "uuid": "caa2b9ed-61b7-44e5-a655-34c8b328b8cd", "comment": "Malware payload (AgentTesla)", "value": "8c2ed6fe835f1167c7f405a98e9368e4bfcae6444fa0b80bf2b4883c59ab3bf21ccc60345178a97b248ffadd39ff0268", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126012, "uuid": "90628858-1540-489c-b0e3-f83707912b8c", "value": "T152049323B47CC5E6F89C3DF48A1997646AB42E920238F15BD94FBDC6E8B3223C1055D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126012, "uuid": "14aa5bda-cb16-43b0-90e0-7ec6e2406f2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126012, "uuid": "b4b85fe9-b913-44a1-8385-b0312bf25ffc", "value": "384:FdDJkiJOOlImGO1gN4HUKsMQmZjVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalfI:FJ6NCQ4H2m5vqGsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126012, "uuid": "f979861d-3673-4fb5-890a-c85f3c931e4f", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126012, "uuid": "1387fd53-ce4c-43bb-ade4-d461670d063f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126012, "uuid": "e2998f63-2ee5-44a2-a0f5-c0d621d28203", "value": "MT0177709223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4994fce-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105450, "uuid": "e1a7d585-382d-4a17-b3a4-9401910aa039", "comment": "Malware payload (Formbook)", "value": "d977ef7b6ea8f839a29022f878e6779c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105450, "uuid": "04c14255-025d-4346-a68f-d30024362978", "comment": "Malware payload (Formbook)", "value": "2d1a6fc2908bac0f7870588ab6f35467ea691f17ba2cb130b62fae506d630046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105450, "uuid": "88247fb0-2ac3-4e6a-8e53-9110b37d85b8", "comment": "Malware payload (Formbook)", "value": "0b34416e082d23acd8b5bb10f895ef2772f7706d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105450, "uuid": "6665c759-6558-4baa-aa42-a41e56b83a9a", "comment": "Malware payload (Formbook)", "value": "e7724db8a75ed40887568dc9ec8feabfc7ec7da3c27a8dc6fe7c92c425b1da3040759d040dde9f184a08439e7b2aba7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105450, "uuid": "ef656bde-23d3-4a4a-bc9e-be2a7c51bf80", "value": "T1C444127629A0C443D9338B312A792BB71FE9933520F2178F2321676E7E35652DB8E351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105450, "uuid": "2567acd4-7c3a-467c-a2b3-b6b2c6dcba8e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105450, "uuid": "2f2ee3f5-c60f-49b7-ac87-90d98316fcd5", "value": "6144:HNeZmk1pSFYz9wV86pTJnCRBSkrl1MNZrWc65eva:HNlyph5AgRBvlm/rt6oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105450, "uuid": "ab070a3d-f4c1-4c70-b855-7921225ead19", "value": 255018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105450, "uuid": "d0bd79b6-4a89-4d3c-a5e1-2547dd5ca598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105450, "uuid": "c67a3f38-204a-495c-a971-8f98287e6fdf", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe8d212-cfbf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652118293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118293, "uuid": "5131b0d4-0224-4612-bcd3-eff3eadc6dfe", "comment": "Malware payload", "value": "2edd88bf4f1749f849367ada0b0dc7c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118293, "uuid": "9123ffea-77ac-4e06-bdc5-2209b1eaa224", "comment": "Malware payload", "value": "2dbad6e0bd99ecdd273a70b3d9c22aca3f3b5809e33f919fea2216dfd5ba8df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118293, "uuid": "3c7c9517-4d57-405e-8a3e-6dcf95896d61", "comment": "Malware payload", "value": "3b17bfcd306ed95bac24fbcc15c2911eea966d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118293, "uuid": "77883e60-d2a6-400b-87ba-ddb7dfb0b0fb", "comment": "Malware payload", "value": "29f377ddc8e2c4a5113c9af0b8cbf6f9bb809c44755e517d5870f399b46e3975d262c204062efdf704b2cb7e3e067205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118293, "uuid": "c4cc363b-30de-4160-a337-716ce3b8bcbc", "value": "T122059E85EB886560DD7D6730A639DC30C3737DEE6978921E14CE7DA73BBB38225101A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118293, "uuid": "b23e5ce3-f1fe-47a3-a4db-ce41c90872dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118293, "uuid": "e6e66d72-a74d-4062-badd-d643ca6347e5", "value": "12288:jAjz4ZagOG7MRxdq+1OCSvf9P+1FyCuK1AINhF3P7r9r/+pppppppppppppppppD:Ejz4wgOG7qkRC2+1Fy1YLhV1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118293, "uuid": "9069f8c9-4f9f-4eb7-bb3e-9d9a5627d017", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118293, "uuid": "febc8ff1-2797-475b-a64d-8fb218c0be48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118293, "uuid": "c278c7c1-dd90-4f31-b2d6-2ae037b3f13e", "value": "SecuriteInfo.com.Variant.Strictor.265337.26505.29818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d17657-cf73-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652085559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085559, "uuid": "946e76a6-4438-4616-b742-e657d7b97668", "comment": "Malware payload (Formbook)", "value": "c5aec2b12f6fbd8f807b995838a508da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085559, "uuid": "bc606531-55f6-4c32-8dce-34c0cb4b792d", "comment": "Malware payload (Formbook)", "value": "2e1a6f7aae62ec78deb1ab18c7b6567d020ad6deb81baa22ad8b0fd5b84d36ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085559, "uuid": "7bb82f0a-3c5d-4641-a010-c843ede48edc", "comment": "Malware payload (Formbook)", "value": "cca2512eb6be09f3f02478ff55ab8a4d1b94af45", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085559, "uuid": "e73c835a-185e-49dd-befd-aed1dc35b925", "comment": "Malware payload (Formbook)", "value": "bbc5a7d7661b6fd7304019f242f08bb06ca18ef7be0c6518f7368168f6ea76604151b677ade2d6c0fd9e20fb80a0522d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085559, "uuid": "f4bab45c-92e1-4d64-8ab4-3b8a0134273d", "value": "T1812412D73671CDC4FA80B6BE60A838098004ED99819E4F4BD480FB2BB675D449CE47EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085559, "uuid": "448de111-d0a3-49a9-83bf-ff263c9c46fc", "value": "3072:VKhgM8EMxCStyyHIixJyTUqRLIvIXYck4Fu6lAdw0mSmSRA4JXhiH6PokiDDWHmt:4hgnzz0yosJyTU25m4BCmSx5C67iSnj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652085559, "uuid": "db02169d-382c-4c1c-b544-17b830ad69df", "value": 212344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652085559, "uuid": "33f21b02-dd9a-4b38-ad8d-257ff00ffe70", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085559, "uuid": "4d0fe59c-4372-4384-a69b-c16df143533a", "value": "QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a4ad0a-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1652104277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104277, "uuid": "34e78a66-0959-48fe-b4a6-3c1fb6222aa9", "comment": "Malware payload (Socelars)", "value": "06ee6ad0013bffd0fa80a66cfa065bc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104277, "uuid": "41b7d97f-6d83-4338-871e-e0b677be01c3", "comment": "Malware payload (Socelars)", "value": "2ebb4b1f070570b07f701207c7c37c1938ad6c946d609cfd437926e325cca27b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104277, "uuid": "9d065cf2-e147-40ed-be0a-d9e042a99395", "comment": "Malware payload (Socelars)", "value": "2983ae7b07a8745d6270b5323b0feecbe6982228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104277, "uuid": "ad283e03-ae7d-4b4a-903a-df8dcac92b75", "comment": "Malware payload (Socelars)", "value": "3f858611be818ce46ebd8bfcda7b7fb031ef351e4f684282b0b53330f68fd1d56f3a50b12f3d11755ed5db7f7deae91f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104277, "uuid": "2e026a74-c70e-4fa4-a266-7c9ead9a8f01", "value": "T133759F11F642A036ECE3007286FF5AFE8D287621071894D7E3C46DA95E715E33A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104277, "uuid": "65c323da-5077-41fa-b77b-dc52800ab3d2", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104277, "uuid": "7bc1c1e4-423c-429f-a1dc-7b7966c181b7", "value": "24576:Mk8p3fEQtgC3a8Y72Yb2+Bi+paAKl0BVcYDP1j0AQ9zRja/Nw:Mpcpte5wv/DP1j0AyRONw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104277, "uuid": "b78ff3dd-15c1-48b1-932e-7529dec5f1a1", "value": 1561088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104277, "uuid": "55f3b683-1c9f-4174-814f-0d551c55e8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104277, "uuid": "6ce9b8c7-db38-4023-a136-67193e7b0a3b", "value": "06ee6ad0013bffd0fa80a66cfa065bc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664e8308-cf7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652089803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089803, "uuid": "6b44dce5-aa79-45aa-b272-b4362a0af07f", "comment": "Malware payload (Mirai)", "value": "653c2692894e36d4caca6ec1f3d9bd54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089803, "uuid": "8329d9ae-d3b2-4246-86f0-96334a559341", "comment": "Malware payload (Mirai)", "value": "2edd4e3f6b92833de54fa70b7dabe4d4983413061dabc9486ac7fe38550db401", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089803, "uuid": "18387fc5-6329-4e66-99f0-7646c4d7fcb8", "comment": "Malware payload (Mirai)", "value": "7d28be8e6a9379e44e1f0c30936e2c4915f058d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089803, "uuid": "66b3a74b-ab32-4b0b-944e-fb7bfca5d475", "comment": "Malware payload (Mirai)", "value": "d476e89c0261a9375c9a38845d853842eccd76a6950d9c0549c1f6cd1feea457fd5399bf0a5e2dfe2f95c614ab632cad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089803, "uuid": "8cab3617-bb98-4cbd-a2c6-16abcd63fe72", "value": "T184732955BCC19A12C6D113BBFA6E40CD371623A8E2EB7207CD156F11738A86F0EA7661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089803, "uuid": "f05ded75-8cd3-4b9d-ac40-729281e1ca89", "value": "1536:msO1+1kA0yiWdT9bcsjxLsJewJJ4/tqGKTNsAqXLHB4mdi/2q9VAc1vN:msO1ukA/MTyz7ym1q/BN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089803, "uuid": "7a0e804b-a07e-4722-9f65-667ad2515fb1", "value": 75856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089803, "uuid": "baf20778-8268-48f8-b7f1-66b6e38b96b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089803, "uuid": "f8cdf6f5-3028-4c05-ac9a-fe41963e03ba", "value": "meerkat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cfcc51-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105125, "uuid": "072bee86-58b8-4ffe-8c5a-5b0a2a101660", "comment": "Malware payload (Formbook)", "value": "7d11a62132715af4eb0a1a0242dffdcc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105125, "uuid": "35d50f59-9e17-41c8-9a0b-162846c9f202", "comment": "Malware payload (Formbook)", "value": "2f312ff94a5ee9ffa556a721c137313793c68a4a33b12b671dc6160c944a1601", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105125, "uuid": "8f9dd91d-51f0-49f5-bd2f-109f16ed3064", "comment": "Malware payload (Formbook)", "value": "97e0780e14e49fea9ccf8e44fe5830b41ce3a8a0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105125, "uuid": "8473a6e6-579e-4d99-8aff-cd5a877d4f4d", "comment": "Malware payload (Formbook)", "value": "c1de2f99250bbb1af9bfe16c3804e777d7d4f59e87918b35b87864e7a240ad7980d116c0299fc7b2e05faed87223eebe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105125, "uuid": "c2b16a1e-bb18-4d14-8502-f2e539969f78", "value": "T12B241232AA18ED2BE9A41878298E7FC3853EFD7835284545A1C0F7C5DFB710234E6766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105125, "uuid": "70f55eb7-e9a3-4ac3-81e5-669a5586271d", "value": "3072:ylwhxwfjDmwyd54tRMVedFLxiHFPqzM1mseMnS8Dfl00njiC5OUc1t:VDARtvxilPCM1NnLd00nuC5OUc1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105125, "uuid": "79c3d49b-aa4e-4178-8e8f-e6779d38012d", "value": 211848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105125, "uuid": "041cf78a-1a72-4a31-86ec-6169a961c7d9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105125, "uuid": "68a1862c-1b1c-4af3-a169-967a86b00c5a", "value": "REQUESTED PRICELIST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59ac656-cf54-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652072407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072407, "uuid": "37bf42b7-c8bf-4ccc-94d2-410bbbde1855", "comment": "Malware payload (Mirai)", "value": "8ba011962d7824205bc732e6bc149be5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072407, "uuid": "bdba4663-56e2-45b3-9965-ba56dda2b783", "comment": "Malware payload (Mirai)", "value": "2f3496461941e9570ca176c25ad7fc6c8b996260f33dd9d669a49f45e576ceb9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072407, "uuid": "799ac220-c503-42b5-962b-85a0b29a813f", "comment": "Malware payload (Mirai)", "value": "739dc2a5983c460bce98af6b2a201c989ecf4534", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072407, "uuid": "74892696-eb1a-4482-bdc4-57c554a0425c", "comment": "Malware payload (Mirai)", "value": "265de03c3c559403e6471c49e952f307716aacf664a10b3a0941322c42ca5c0b63aada3f84336b2c0f0293437dec959f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072407, "uuid": "c83d40ee-d7d3-47ce-a345-84214fe48f19", "value": "T148632992BC819A02CAD412B6FE5F519E331623D9D2EA7207AD156F2037CBD1F0E77241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072407, "uuid": "3cd02346-a419-4df4-976d-bdfa0b19d335", "value": "1536:sWPKw0DX+CaF8wl82EFyELJwq0E4IFDTFUI070R3tvH:sWzGX+n+2S5in+BUxIvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652072407, "uuid": "c7a7659b-345e-4070-bd5d-cf5325122afd", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652072407, "uuid": "8e70fffc-f97a-459f-bd66-eea819b2a956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072407, "uuid": "a23a5a45-dd01-4f73-855a-d974a4fd38d9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8c6d6c-cf5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652076174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076174, "uuid": "6d9d5325-1ea5-4b96-9284-15900807e00a", "comment": "Malware payload (Mirai)", "value": "6254445dc199444286b2fabf8e7238c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076174, "uuid": "96aff08a-ba53-4028-92fc-74a8536c1846", "comment": "Malware payload (Mirai)", "value": "2f8a4f5ffe4661b9d8a80b4a4a6b3280487305f2bd51e2b836136163dc9c5e1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076174, "uuid": "37dc046f-17db-4af1-8e33-0041a3b86123", "comment": "Malware payload (Mirai)", "value": "9a4a3eb0ff4aa3fcecdaa11cd3221d922e32eccf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076174, "uuid": "b47f470c-5874-41da-a718-848e695c4092", "comment": "Malware payload (Mirai)", "value": "2c408504383ecbb6addb530b6d81edbbd4be658cbe26c605748220d5906bd5e66391e2016c2b60703be621bb07354d32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076174, "uuid": "efd94a9c-bedf-4906-8cc8-033621974c3e", "value": "T1A9539E63C4641DA4C1544AB0B9288FB61763E60087637FF6426ACBA99057EFCF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076174, "uuid": "85a5b8b7-507b-49f1-a63b-dce741b3b738", "value": "1536:oagv1AOp/umClcqseqyYGsYh4ESijKmR7GrxhCKkdV8:ox11KmqsdI4LiGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076174, "uuid": "61db650c-f744-4b27-b757-8ed25351ad4b", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076174, "uuid": "83151b83-d627-4823-a145-5a1f12398123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076174, "uuid": "0560df35-0797-49ed-b1b7-f763d5b6b668", "value": "6254445dc199444286b2fabf8e7238c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd73e71-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652110271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110271, "uuid": "be050ef1-4adb-4e7f-84a6-6a1284e6ac7a", "comment": "Malware payload", "value": "b8748e2e60b9eb93312890a3e099c78a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110271, "uuid": "39f7e321-7324-475f-8fa7-c0c2cec1f033", "comment": "Malware payload", "value": "3072a7ec1f71a9adc7a714092172e4b763a9f7128ead2ae67e72663863b1143b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110271, "uuid": "ac044cd7-3b4f-4623-9348-2bbd615664e9", "comment": "Malware payload", "value": "9fb824f78ebe9e517b146b686c32627566606bc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110271, "uuid": "400f7998-d8cd-4838-818c-b7999d2536a7", "comment": "Malware payload", "value": "49d7ab8e2b45719ebe2b40d1019fc9d29113558c0448ccc5e85c04745351aa8a77b20a5c370e735d65276d2066b80148", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110271, "uuid": "ddf8c7a5-e2b8-44b3-8d80-e00ac001f3fe", "value": "T1BBB44C5A1B446F20C1FF6A7096687161C3F35CDA5FA9838F4882B9D07B7A3857AC06D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110271, "uuid": "8c986b7b-59ed-4f47-804e-cb4a4d9dcbab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110271, "uuid": "7743ed7c-0e99-42be-ac6d-ee184632f705", "value": "6144:Ayx41J87RRWXKiIHHmzTqyrei4ZC7rY1Zn49yubdinejg2xjnDM2bz+I:fsaiyHIGAe7ZO8740u5iejMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110271, "uuid": "98e402ad-03b9-46a3-a844-e4419a01c133", "value": 516872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110271, "uuid": "f89918a8-0aa9-46e7-bc2c-03273c992788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110271, "uuid": "2c046f2f-f5af-4a73-9a4e-b2ed4bd12327", "value": "INV-SCL0093-05-22pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e85289-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652104667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104667, "uuid": "d71b6d26-2d55-4b6a-b6a6-766fc2da8d9e", "comment": "Malware payload", "value": "e698cb01b9d3c252130ef752b266748a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104667, "uuid": "38b2edff-45df-4e95-bde0-82026553b038", "comment": "Malware payload", "value": "3161f0a098234a9c7ebcaf2819e82853320b2e8fac9a7170779f7cac16ff0aa6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104667, "uuid": "a4410e4b-1437-47d9-af2b-21320d53a0a2", "comment": "Malware payload", "value": "9e3d225477ccac6897d326f6706c2101d41caba9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104667, "uuid": "a6f58edb-ea83-4b35-9439-1574a4966800", "comment": "Malware payload", "value": "c2246babc4aa9525d686d6fca73687a518abc5e75b0c1170cccca57752d4538574fa9dfb7cb9b3b8b5ac33264d3d2a4e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104667, "uuid": "090ed356-dd9c-4158-bb7b-cb0219ee125f", "value": "T124266D23B284753EC46B2A3A5937A758993F7B7139268C5B57F4088C8F355803B3E64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104667, "uuid": "0e639ebd-27e9-400c-b46b-209a734d3567", "value": "98304:S1v2/L6vr+0yRCtqihrroxPdFkCT2T8XMfpVGjlaDVpAEdYAA:Swz6T+GqKrroxPdF92wXMfpVGy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104667, "uuid": "291bc084-751a-4a96-9c90-7260db388967", "value": 4750848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104667, "uuid": "a69efb75-6149-4d9c-8885-06ff0f283f63", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104667, "uuid": "9d7c7294-01cc-45cb-9758-0b6ae95a53e3", "value": "Arch.EndesFactFecha0805.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7948f5ff-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652105297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105297, "uuid": "15a2f101-2b03-47f3-9bf6-95b34c04ff85", "comment": "Malware payload (RemcosRAT)", "value": "fccfa91cf5d87f2a0d162ac8254396db", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105297, "uuid": "69cc4eda-7da5-43d3-a296-bb2185d937ab", "comment": "Malware payload (RemcosRAT)", "value": "3187611531a581563edecd336427c050d1d54435d541044e21c33a8fcea93439", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105297, "uuid": "2812ab55-eae2-4e80-a448-f3d6aa81e73d", "comment": "Malware payload (RemcosRAT)", "value": "06f334f7c77070491810054ca5d663785c155995", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105297, "uuid": "0bb4172b-91d3-40df-ad2a-2267b983403c", "comment": "Malware payload (RemcosRAT)", "value": "18e91ad92b1b0fc2046718aa43e3e2f9c4c5828099d2c0b0d41c4e49a3a5bb8add071ecf0e23192d546d331fd19cd993", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105297, "uuid": "11e138c1-8d07-4f09-a47c-b807d4c6b7bd", "value": "T14D51744E709F756055397FB7EC1B046EAB330B43A6A405467A09AACACD7803DD6C0C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105297, "uuid": "b5041be8-bfd1-431b-985e-f65b64a53554", "value": "48:S19QZMH7JslY9NZmlKoeqe6JF1rSh0SRxh1/WVtoHozvEMbs90Bd+lPDv:EFrcJF1rShXRgyme/Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105297, "uuid": "ad60a835-58b5-4735-86b7-543d3ea03fff", "value": 3069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105297, "uuid": "73ed151f-ff58-40b9-958b-8dbbe270341a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105297, "uuid": "7d740f24-5dbc-47cf-8b09-c46d416447b1", "value": "CMACGM-WBINS9013246-20210714-125247.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57ee94d-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652110632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110632, "uuid": "e0a51745-9206-48f3-8e28-97180c694a8d", "comment": "Malware payload (Formbook)", "value": "6597abe19d7fb19e1812b00cfa40efcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110632, "uuid": "76e27400-35cc-47f7-b0cd-980c6135f632", "comment": "Malware payload (Formbook)", "value": "31b57c8bdc8e2a57aab3585b53904eb130fe155c96f095951eccec5a02a6451d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110632, "uuid": "6ad76edc-597e-4fa8-8127-220aec1c0634", "comment": "Malware payload (Formbook)", "value": "efdcb73b5059dabf2f295e347d3cb936b5e467db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110632, "uuid": "99a200aa-869d-4d7f-9832-a42c9480cec2", "comment": "Malware payload (Formbook)", "value": "7e582c1ad127a8a773a73682065a27504b1d6c8b6aef9d3ed5cf84918186971169ae95b418a361e0c0f42d6d87211fe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110632, "uuid": "b4525611-292b-417b-9820-41371a031a9d", "value": "T152E3519DEB85B314E8581B3124B9461C9A1EEE2CE4BC650E3D5D35FB6FB320019D63E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110632, "uuid": "f2daef0f-a3be-452c-8076-69a71040eed0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110632, "uuid": "54b3c2a6-0beb-46ba-98bd-bad39892bff4", "value": "384:0ybcBwxx7EUcNB/17VbqgPP0coCFDGVHov1YavbDIybDExqDwwL4MxtX+X8GbffK:0ybo0BYv2g30rwD2H7BX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110632, "uuid": "e3dca1ac-410f-485d-b590-e50ea1229d6f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110632, "uuid": "2879aa32-52c8-4140-b549-742d19d4446d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110632, "uuid": "b95cdb6c-902d-48d3-bc26-c188573aeb75", "value": "6597abe19d7fb19e1812b00cfa40efcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2929b79a-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130932, "uuid": "69e095d9-801e-488a-91b7-cd5c76174ff8", "comment": "Malware payload (Mirai)", "value": "9511316ef89f1b12254cac467f6bab2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130932, "uuid": "12b9f990-f0ab-4c25-a477-d5774ffe522b", "comment": "Malware payload (Mirai)", "value": "321f6b7e38a0e452300c5437699de64e9e63d54d1a2aa3ddfc024735cffe78ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130932, "uuid": "aabc7520-abc8-4b37-910f-aa775d8f33ee", "comment": "Malware payload (Mirai)", "value": "13eb4f6a08159e6ba94bb52c57448262a2ea0c92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130932, "uuid": "326f136c-2da3-40d8-9154-0d0c897add57", "comment": "Malware payload (Mirai)", "value": "963e4d399b8cde028ec95cc27641478870a1ad5864f02b938f6381f39ce71c1f41ab61816862443387c247128636bad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130932, "uuid": "ed98e2d4-8e21-4cd7-b4eb-5b177364d7be", "value": "T1F5032995B8D18A16C9D41277FA2E408D3724A7E8E1DF33139E163F507BCA91F0EA7681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130932, "uuid": "9d789620-602f-4b6a-ad14-f14eaa712684", "value": "768:Nk4jLHvwsy2UeyehzN5RUr8I97T97fLShHKK65S7wCDpew1OD3EagNCAprg3vvm:VjLPLUelRUr8Wd7fWhKSRd02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130932, "uuid": "973ea1ab-1cb3-4766-8a30-a5479e5244cb", "value": 39760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130932, "uuid": "02425e97-43f6-48a5-b18b-904ed13e25d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130932, "uuid": "1c1d488e-b358-40bf-bfb5-8e9d5f202109", "value": "9511316ef89f1b12254cac467f6bab2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe127ec-cfde-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652131373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131373, "uuid": "0acc52b6-82a0-4d41-9c03-5a9ace95fbd3", "comment": "Malware payload", "value": "24273814c988cf5b721c977995dcc8e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131373, "uuid": "1603e380-7e4f-4c5d-b9c9-36fcae3c3ac9", "comment": "Malware payload", "value": "32739f5c7a1e396477b40ae6329a06f4d88454f73c3c0b998d26c9e4678ea997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131373, "uuid": "187df6f3-e17b-4d9b-894f-dad7aacc9356", "comment": "Malware payload", "value": "afcbb117710df7e86399e3e9d1da6f50f99c9696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131373, "uuid": "0a2bab3f-6e67-413e-8c23-3706c5d25a4b", "comment": "Malware payload", "value": "2d6cabab6c0b7cf77abf3f8293095d4ab36d5347575f3a86bc3ef4d55e3f32385cfe037b0d576480a3d3f14bd4130b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131373, "uuid": "53337aa8-bef0-4efc-af24-a59ac9fbe871", "value": "T140558C938341531AE393703581DC9E35B50566302A3F7CA7AB051BBADB2B3C16978F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131373, "uuid": "5b6f85a6-9ebd-425e-93e6-f7d842ebe8c8", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131373, "uuid": "7daf387a-1bef-49f5-b504-dfa313249137", "value": "24576:ZczvnNWQ6FghtkjOYZEupTXJ5aD2n3acgceaxBwr5F3kym4T9P61DPTwbLfUi4n/:yzvnNWpioOYZhZXe2qc/vq3E4T98PTww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652131373, "uuid": "eb69665f-810d-4891-a90e-b301fbafb34a", "value": 1319392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652131373, "uuid": "a8b613e6-a856-43ab-b147-972d4f0d0c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131373, "uuid": "fae0c4f3-b464-4e03-87fb-0602c2c8eebc", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22091262-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652107298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107298, "uuid": "8505ba16-8318-4623-b27d-49f662fea2ee", "comment": "Malware payload", "value": "c33aea67a5edbeb5d1dd696b22c0bbf1", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107298, "uuid": "1abac79a-028e-473a-b20b-2e3d1007be89", "comment": "Malware payload", "value": "334d55769fd2c77357db70fbca8c06f29eef95b66c47df7cfe90796ce44197a9", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107298, "uuid": "08b27ea8-fe6b-4af4-85ad-4ecceb519022", "comment": "Malware payload", "value": "1ed4fe545fddcf6421f13c353990522e39b0904c", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107298, "uuid": "4635ba25-f9da-461d-a0d7-0ebe2b009d79", "comment": "Malware payload", "value": "b9a8bc5df2c719412bb4511ef69ecf6d678707e8093935deda3fab7f0a1177a876577ceb8aeec6f0110977f13b3b7839", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107298, "uuid": "ecacaf2a-7df8-4cbf-a838-5eeea3bf7188", "value": "T1302733C1EBD164F4E683053E80B6BE29AA347F115B32D2C7D7907502A8F31D15E7A2B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107298, "uuid": "89dce5ac-c664-44dc-9732-438b29bcebfe", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107298, "uuid": "49833102-ff41-4816-8e95-38c8d01b521e", "value": "393216:QukBVRJCcDIgVQ4UnG29ThedL0cmpDWVFTHKNBhF7ZO2cNvR:RSiYIghEP5cmpDKTH4Bh22c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107298, "uuid": "cd8bd836-01ee-40ed-b74a-d3abe7968bf8", "value": 21158880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107298, "uuid": "1486f799-041b-4f6d-a0e5-2096ce16ac6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107298, "uuid": "0367996f-bbb0-4586-b7f2-7c08495ae34f", "value": "zoom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e00a6e5-cf60-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652077414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077414, "uuid": "883279e2-ea65-4ea4-963a-88bf03b78e07", "comment": "Malware payload (SnakeKeylogger)", "value": "108460e24d50b1558e4da291eb250eba", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077414, "uuid": "e04976f1-8143-4f98-b2ab-bb82629f1fac", "comment": "Malware payload (SnakeKeylogger)", "value": "35348e4c46a60fa5f0fd8e7cd948e9d4526b5e28cd6972b0119741bd247b34e4", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077414, "uuid": "d2ad2651-ec66-445e-ad18-9efa00c8e52c", "comment": "Malware payload (SnakeKeylogger)", "value": "7781a244b191d35257d641677dc1ec13a7bc5e81", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077414, "uuid": "08c5f9ab-6689-4aab-a521-891a73e9af11", "comment": "Malware payload (SnakeKeylogger)", "value": "e1c3c1791511af9a71ba486b88f516834c1adb8a0c07e8de23302cc9353ffc935ac187acffdf5bbb04e92a93f7925ec1", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077414, "uuid": "c85bdf29-e0e6-4ae0-a4b2-84631027b3fc", "value": "T155A423DDAD0A96247C09C7CDC1B5CF5130EB0D4D3E85171B2AADAEBD124C19ABAB24D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077414, "uuid": "1b175bad-8271-48cf-a535-eb33cccfbeaa", "value": "12288:YyQS9U5PY+a4+vM8MonMemE7OoxdNLzP0eXuNZSfqCpw/:YyQSr+4vlMonMemE7Oo9LzP/XuNZSE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077414, "uuid": "443881bb-cbf8-4e44-a402-b559aa481043", "value": 481656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077414, "uuid": "ec1108ba-3406-4556-ad12-420296457a8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077414, "uuid": "94ab84da-b1f3-42b7-86af-ace3378d7d2f", "value": "SOA,pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b24a6a-cf5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652075332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075332, "uuid": "9ac9caa0-581a-4d7f-bda0-19a5558377fd", "comment": "Malware payload (Mirai)", "value": "8f29b6459eb362b74893d0900f8d8bfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075332, "uuid": "cb2887cb-5258-4ea2-9fec-c33d8ab0fa1a", "comment": "Malware payload (Mirai)", "value": "353a5e686d7328f6cc92ca783b4bf4f84bcbe8ed7e347642b01af33415984ccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075332, "uuid": "d44b1cfe-5642-4e9f-9fdd-40c3dfaea945", "comment": "Malware payload (Mirai)", "value": "1a15b0a725d19d8de4b76b86a9abf637ae92df39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075332, "uuid": "9596ba71-59ec-4ab8-b28e-f526ad4ce7a3", "comment": "Malware payload (Mirai)", "value": "72c67c191889e99adcce6075612b7e57fa7965ba1cd22c433e480d47a7e5c9a771413c5f3a96a19e4a79dfd2951e1e81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075332, "uuid": "0ad8eb13-b72e-4d44-b2d1-56b8c28afab5", "value": "T1CF231896BC91DA0AC6D023B6BD6F60EE330163DAD2EE3247DC145F2476CA90F0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075332, "uuid": "581964f6-9185-4bd2-ab55-1ab71e2c7feb", "value": "768:MILmQU8Fug1UrvDjSS2xYOx+2bziW9WX2yF4GugnHbtwpYMS1HKKlvqBJ5e2by6K:e8IgSrbjSSF0iJ2yF4sn7twqZ1HXl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652075332, "uuid": "58833614-7aaf-4596-9f0a-84bc09f33a6f", "value": 48268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652075332, "uuid": "91a022d1-61a7-4c65-98f9-110eeb761ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075332, "uuid": "b63bf9ce-8078-4f5a-8c2c-a8844e6d6324", "value": "8f29b6459eb362b74893d0900f8d8bfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7822e1-cfb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652114347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114347, "uuid": "325ce0ec-a4a8-4ca6-8bcd-2fcb487b467b", "comment": "Malware payload", "value": "5d57af24baee43d441c3254f810125e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114347, "uuid": "c02bdfe3-7824-43e7-8f51-4a0c0494ca1a", "comment": "Malware payload", "value": "365513da20efb05517fcb10a348acb39e3391a5ec8cb44c8a6f15253e661b401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114347, "uuid": "5d94be49-124e-40cf-be17-7b82bc543d36", "comment": "Malware payload", "value": "558bcfd10b9bcd7cd33e05184fde0678dfc73d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114347, "uuid": "b2ae956b-caf8-483f-b843-a2020b4c202e", "comment": "Malware payload", "value": "0423c1946133cd180ee6d4364ea595c84dd7216d80c63688f668995362694be7f4c368643f45b434a40429922838f3c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114347, "uuid": "484dcf79-e4ca-4abd-a20c-ced7b4be6828", "value": "T17A15ADAF7FF035DFCC16CDB5BA742CB4962027666237924290D315B9B90DB978E034A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114347, "uuid": "22d5a70a-5667-448c-b1b1-9ed23027b369", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114347, "uuid": "e0081d2f-b489-43f7-895d-ff4b612ad5e3", "value": "12288:Nb2L2I7+1ceTG9UJREFAZk6/AEsa1OGHNeLYD3urY2MRc6ktF8opvbbWOt3Cw519:B2Y15G9UJ/2ReeSUn8cR7plV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652114347, "uuid": "1cdf87b5-d9e4-4659-aee4-6d9194dde299", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652114347, "uuid": "b641a729-2dc7-4163-9295-de605470f326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114347, "uuid": "5c9838b8-29ab-46da-965a-ca9d5b89d801", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29013.23602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f238c5f-cf7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652090623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090623, "uuid": "fec989c8-ee68-4690-9cd5-00d90e161073", "comment": "Malware payload (SnakeKeylogger)", "value": "770a047841cafa1b88acb6e4e37e7ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090623, "uuid": "479793c7-baa3-4c3d-a0dc-30e89a722d05", "comment": "Malware payload (SnakeKeylogger)", "value": "383942112459c482b48bd23b998c08d1fb9f6cd90cda7bb11c227f395a353bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090623, "uuid": "6f9e7c0b-0fbe-4f89-9109-fff3874f13e1", "comment": "Malware payload (SnakeKeylogger)", "value": "7119888d7a1ac7e3f2c0256aea668d5e3cdaac9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090623, "uuid": "e22c8052-49eb-4134-be2a-25f4e932e7c6", "comment": "Malware payload (SnakeKeylogger)", "value": "1fb7a9cee34ebb40ca104e9c7bc665928663b5d9ea716a98e687d4dfb2a03487e5d5875332bcfd757268d518a9aa7f18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090623, "uuid": "7e29f28d-ad00-409d-b398-26e98d1b91c2", "value": "T1AC052205F6D55362E6792BF0C462168007F6FF6D78A2FA082DD136DF2A733816A40B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090623, "uuid": "17e92f52-0dc8-4a2a-ace7-9155d0d1b79a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090623, "uuid": "dc897237-fb48-4c63-a890-bd6322e50ba3", "value": "24576:Dm2WxBiDoTNnsjgybVHNEWzKfjDz7DcFKasueZ:jWi6sjgybVOdjn7QFKasue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090623, "uuid": "24c7f2d8-d80e-4eeb-aa79-7cb71b763fe9", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090623, "uuid": "18c6106e-ba46-4f16-9ece-487327063cc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090623, "uuid": "52e4b724-13c7-4127-9c37-98dca30d6c59", "value": "PUR-RFQ-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41764313-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652104344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104344, "uuid": "bbb2bc48-2905-4133-addd-6021622723e0", "comment": "Malware payload (RedLineStealer)", "value": "9328cb13ef0f3edf259d43f4f51a1a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104344, "uuid": "f732dbc3-2bf8-45d6-91b4-17f8e35321a5", "comment": "Malware payload (RedLineStealer)", "value": "392dc33b0c5e7b83152c45b102c6adeb180074924dad38ddef139f6a5ff33344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104344, "uuid": "f7031351-6161-4f5e-8452-70a1c6929579", "comment": "Malware payload (RedLineStealer)", "value": "aadb514bddfe219fdad7610b5343c3b7d97aa6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104344, "uuid": "59f20cd8-c980-4721-ae0c-d411f3d4098a", "comment": "Malware payload (RedLineStealer)", "value": "240e1b98e1cd7876cfef0da2ec919c9ed3620527b41872a44247ee4a9dee7dfc412730e20aa40436748aff4eed9c8036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104344, "uuid": "d5995d27-1bf2-4175-9160-0923cced193f", "value": "T11C756F11A7A6DCABE2F26C314D665F9C9928ED06CD76023B13A7771E2FB13C80D5E604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104344, "uuid": "24d1e2b7-64da-4f90-9baa-af4299e46f0b", "value": "2b9f3cac78ee8f3fdaa9aff15dde58be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104344, "uuid": "08c613f5-4ec8-4cf6-81cf-6b0d54036d52", "value": "24576:GNEe5z96CLcVUnAyt0Djdq6PHbj9t3ccIPvN7g4J:GNEeV96gHAyt0lq6zfMcy1g4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104344, "uuid": "c1d1c47a-b330-4103-840d-dd9895375071", "value": 1560912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104344, "uuid": "331701d0-44db-42b2-b999-a1c04c30b48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104344, "uuid": "c6789c6c-4251-411a-8123-683afa3cd129", "value": "9328cb13ef0f3edf259d43f4f51a1a7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f5732d-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104249, "uuid": "3861fb6c-38ee-41b2-9baa-330234e1d490", "comment": "Malware payload (SnakeKeylogger)", "value": "e25861d77b7b019e8957ac311aeb0562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104249, "uuid": "a36b8c4e-cb9a-4106-b89a-cbb5d9ae9732", "comment": "Malware payload (SnakeKeylogger)", "value": "393b5b9f449f53164245179499fcf478d97a900559dccaa1719ec3ace64e724d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104249, "uuid": "4c2c071b-e985-4167-becc-b5ca16e94cd3", "comment": "Malware payload (SnakeKeylogger)", "value": "ac9bea56942fcf4b0198b907c37a8e9f21a261c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104249, "uuid": "cd32bc13-91b8-4645-bb02-010806bf6324", "comment": "Malware payload (SnakeKeylogger)", "value": "4ebcf4eeafe1a7ae10c3fc9310e00eba641d659df4916940b2bde66a633f0c9be1b8622a322e3e322e9a4569d9d52860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104249, "uuid": "1491f9d2-8de6-4955-b640-8cc9f75bbc89", "value": "T1D5850A8DA204444EDC498672ED736BE32773DFA95C62024AE397772AE8773B910C4B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104249, "uuid": "fef8a5db-9cae-43cb-a885-7444affdf64c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104249, "uuid": "7dcb133d-03d9-4dcb-b08b-e9e3b1e29754", "value": "12288:oPWLOxozW0LDRs/+NliVp9Qe9JrLSm/0RLIzrhMitfN3peWr7Lx9i/M5fRkvyWkH:oVgLNsGNKrQe9Fum/+l4fxhjEam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104249, "uuid": "0efdf937-fc50-4dd6-8c8c-235d5014dcaa", "value": 1794560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104249, "uuid": "aa379d4d-9e9b-46ff-b6b3-3dbca9b225bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104249, "uuid": "76001899-f089-4dcb-823a-562be0f02e0c", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea1c906-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652084797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084797, "uuid": "594abd68-c078-4dcf-98ed-d7ea2b095a35", "comment": "Malware payload (AgentTesla)", "value": "ab2df0a9df68c480f6e24f687148d8f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084797, "uuid": "5b4dcf0f-2f5e-420f-8788-9dc83f1d99f3", "comment": "Malware payload (AgentTesla)", "value": "3b07f6e21197fd6db8b751fb3a3dc3350d9e491ba5e1ea46ede5e168ea812a28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084797, "uuid": "20af8696-9e45-4af4-800a-2d1d7ea69fed", "comment": "Malware payload (AgentTesla)", "value": "ab1dc6e7a5c6ba05a5186dacf1e3440f33788c58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084797, "uuid": "4b708541-b3f7-4633-b6ec-eac02748e786", "comment": "Malware payload (AgentTesla)", "value": "3461f3074d2e7b816230d78ac928abea7a1eccd566ce6f868f94e0fb54c7dcd1b09e69cab7a7dfb226dbdc1626b1c835", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084797, "uuid": "61328b0c-6436-4e58-8c5c-6f93ea482cf7", "value": "T175E4220073FA6BA3E7B933FB6449358873727E24B124F6997DD832ED55E23460460A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084797, "uuid": "54422a78-9966-4292-b6d8-74bcbf6daf55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084797, "uuid": "f1ab246a-9f7d-4b07-92e1-5b8557134a20", "value": "12288:3Uamu+xF7UeyntQduoOhustUf2JJ2J+c4sDpxX0bURi0pJNJr2L2I:zmFcgUpJiz4Yx9f3r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084797, "uuid": "44bd78f6-98b1-4953-9c1e-507b79061f11", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084797, "uuid": "6e80395c-f46e-4239-812f-f5c92d0b227b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084797, "uuid": "ecf676b1-9ce5-481b-ba05-3f675b013f27", "value": "Proof of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a7b6f6-cf6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652082878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082878, "uuid": "bad7cb3d-d11d-41a1-b90b-c5846fb4461e", "comment": "Malware payload (GuLoader)", "value": "fa5d48b46bf91dc8e1fafdbd9c1ca6b9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082878, "uuid": "bb131254-a538-4a9b-a70b-9e013fdd76d8", "comment": "Malware payload (GuLoader)", "value": "3b3931f1589232a5c592af652dfc0f2048f897508166b1610437254083c0feab", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082878, "uuid": "31397ae9-6048-41bd-b23f-947c0a6daf74", "comment": "Malware payload (GuLoader)", "value": "b1d4744bde29c18e1996436c3fadd39b43373a24", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082878, "uuid": "19fca670-6a76-4bb6-824e-148f1692ebfa", "comment": "Malware payload (GuLoader)", "value": "1b10f6153a0210faf3a47fc3533022c1e5fb9111ee9e2c8ce58aa646f9aea5dcc9474ce4d9f7b412ef739a93c7490d1f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082878, "uuid": "5de7bcd9-c110-44b8-850d-d305223bb59e", "value": "T11F24B7C0421D15EA825CC64CFCE0366A0F5698CDFA27BA5EA3A15F1F0351127BE9CE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082878, "uuid": "0b306d21-5eb8-4453-a0c1-da033425d77f", "value": "3072:g7EhGHQ2OM4Gg3fqhp8O/DLr1F0wW4JmYb7TQADl:govHSPLNmiTQADl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652082878, "uuid": "06a3e6f1-ef65-49a8-bbc0-53e7d85d0ed0", "value": 226122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652082878, "uuid": "7df01688-c985-45ed-8a7b-d9ccbd17d3f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082878, "uuid": "b86855be-fb8e-40ef-957c-f2f84993eaac", "value": "doc8393983_884748399383764.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97eda02-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105056, "uuid": "73d4ded4-273d-47da-8e56-24ce98a3211d", "comment": "Malware payload (Formbook)", "value": "af1a441186ddb7fb72b35730967932cf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105056, "uuid": "56eddaa0-ab57-490f-a956-0adbddb80b35", "comment": "Malware payload (Formbook)", "value": "3b6ec320621d27418a5350fe8f2156f49fabca9bb52c2ecfed8e69256a86ea98", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105056, "uuid": "34963dd9-b00c-4296-8322-6586cb14952e", "comment": "Malware payload (Formbook)", "value": "69db10e3329a0e0318367e8cfcf57f1103aaf30e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105056, "uuid": "a1ab86a6-f025-42ce-971d-f418a82a71d3", "comment": "Malware payload (Formbook)", "value": "bcc3321ff3be10535bd15e49bf0da0d012ef949e40b9eeb6135e37a10f0e8c91f5c8b66d6c758908c9c105bc7dcb63f6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105056, "uuid": "571fe568-c557-4218-b9da-7ddfd937fa3b", "value": "T14424122C773D083BE0BDBE31296E1A02851DBE19B45361BB7134FE750534C28DEB4A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105056, "uuid": "db9d7761-441d-4b8a-b6cb-1e30d593da99", "value": "6144:DUzqCMMke0n+dnt8xlMaZiT83xJ9h0Br1fE:oza73+dCNU8B3GV1fE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105056, "uuid": "82a2f485-d241-4dc5-9975-4bf2539c75d0", "value": 211880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105056, "uuid": "dbf2be01-c312-402d-8214-b20790cb15a1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105056, "uuid": "7b2f2538-6f68-4700-bf19-f4c8ff60f4c8", "value": "DHL MAY INVOICE 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f2fbc7-cfaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652111517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111517, "uuid": "636a15a2-4a86-496f-a2e0-d4c32966e784", "comment": "Malware payload (Formbook)", "value": "1fd222200c62dc85bdad2963794adb77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111517, "uuid": "d54532fc-56da-4d21-b8e0-f501aa37a8bc", "comment": "Malware payload (Formbook)", "value": "3bc803f9caaeca99da460ce804bfc9bf4cb8c1dc33d08016002e4fe7263a6111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111517, "uuid": "645b9d29-fbdd-43da-9cf6-d1bff63e2b30", "comment": "Malware payload (Formbook)", "value": "fd32bb170497d873cc7f0d23c8ec61ae185e8567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111517, "uuid": "0046ce36-adcf-4762-b02d-c60d2a409e1e", "comment": "Malware payload (Formbook)", "value": "5fcae485c37b3d52cce84b4f99e24c99e2120960020338e0181d53bae070a8b95f6eaf06634eb0d6c881d560a96ea0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111517, "uuid": "d80e8187-aac1-420c-969d-c3974ab0aced", "value": "T1D60549704B1B15E8C9F1BB79178228FC0BF41DC7D60F1D80BDB919AA26749AE16DB027", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111517, "uuid": "dbd1789e-a169-4fd5-8be7-6505e26f572b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111517, "uuid": "943ea74a-bccb-42e0-882d-2f7f971d77b8", "value": "24576:J0EKixstRGS7bUBevYn0ngGmAEmb+dEGDxYyw+:ShWGUBevY0gUFIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652111517, "uuid": "04f98c87-f5c4-46ff-b55e-38fb1750fcb7", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652111517, "uuid": "bc3429d0-1096-42b7-9ccd-f120373bd314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111517, "uuid": "7e87e3c6-8727-4a04-bd34-1191f2b32fd9", "value": "SecuriteInfo.com.Variant.Strictor.270431.23718.17913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab4cf6c-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105380, "uuid": "1ede274c-c105-4f1c-a142-36a2f0932729", "comment": "Malware payload", "value": "192d6a8128dfd68a93826533b101ea3f", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105380, "uuid": "b314ab94-f0d1-4df7-a9f5-afac4fe71428", "comment": "Malware payload", "value": "3c273955e8d104977f01ea95ab37d94433f8f859d2186bdfa2ad9641cad69d3b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105380, "uuid": "e5778cee-68c6-4150-8364-fa397c47f311", "comment": "Malware payload", "value": "dd1b95383d55dc9f42a3ecb2080ebb3f98f4dfc7", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105380, "uuid": "281f306b-a122-4a4e-9a16-928cb24b9f4f", "comment": "Malware payload", "value": "bc97c64039c3d81253f48e53c98acc74e32fd9672e7445f379a256dd961e5609b37b1f38b615ea79426f853d40c9d102", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105380, "uuid": "8e1976d5-025d-47f8-834a-b202945824b5", "value": "T178F2BF9714049E13F43986B97E0B0F8C6F8ABE2D514179EF11854E8B363176BAD8E52C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105380, "uuid": "f2c4cad6-602f-4274-b9f5-868950a4bfa5", "value": "768:P2MuxSP4vRqZfIo5U96RS2G3WU+6eQ/eieseQNP8:evxSPERqZfIy4Z9eaeie08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105380, "uuid": "1244015a-27c3-47ba-a8b7-947fc0445312", "value": 36156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105380, "uuid": "c0c99139-bf73-40cd-84e4-067033969b66", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105380, "uuid": "821e79cd-f0ac-442a-8783-1faa66c904e9", "value": "Image Payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88e5183-cf6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652082720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082720, "uuid": "d3f3f6b0-84a6-4c9b-86c1-eabc1739c363", "comment": "Malware payload (Formbook)", "value": "912710b3bb7718ac26b03de4d790975c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082720, "uuid": "2786213b-a8d6-458b-a722-24df22b363a4", "comment": "Malware payload (Formbook)", "value": "3c57ec7ea03791fee9e9c337171a74420550482bb9c1e626aeb7e183bcf4b195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082720, "uuid": "140b6f4e-6200-4993-9a6d-2c4bc2d32b6d", "comment": "Malware payload (Formbook)", "value": "3d0aa71a52a470e7a9ec21ac0c5237f90a8e4fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082720, "uuid": "416dc347-cab4-4cb2-9fba-cb2dbf8b4b75", "comment": "Malware payload (Formbook)", "value": "d2033e5f80ac6efe7128cccb4a79073c39a69e0faa54bcd01745b41a17402221a426d3f8d7fca86b0c9537b94d8e6b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082720, "uuid": "f3fc9b63-75ac-4c12-b402-e2ebef82cf74", "value": "T1ACD4220672D20776CA7827F9A021514003F73E3E7872FB8A2EC166EF5572B466551FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082720, "uuid": "a0c31432-7292-4bd9-bb8f-36f03ffd1685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082720, "uuid": "6cadb8a3-113a-496b-8b9d-17be0d3924bb", "value": "12288:Xtj2L2I83ysbN9uF6eTnJ02H8AaFSGRXKew/9b7v5Cg7aFY:Z2ub9CB19EpMpBCg7EY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652082720, "uuid": "fdf4cf3d-838f-4e2d-8514-4244de0b0cb7", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652082720, "uuid": "c1e9d8dd-46e7-4eb8-8e03-664d96ad3d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082720, "uuid": "f57157ee-c4b9-4aa4-9c51-9ef1d4f7b476", "value": "Order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e34699-cfbd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117233, "uuid": "2488754e-e4f2-4028-9b89-7ecc0ceb0801", "comment": "Malware payload", "value": "227d41187a4e8f2553d330cf50e1a2f3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117233, "uuid": "370598f9-b97a-4b16-9c5d-6c58a9be7d69", "comment": "Malware payload", "value": "3cb808cc45e6e28df58c4519c96fddae62d7e1eb41ac3840781e0522fd15a2e0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117233, "uuid": "4be74277-14d9-4c84-8c36-1481e5115ac8", "comment": "Malware payload", "value": "27abcee560e651053da297d27f6f0e98a9e4e012", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117233, "uuid": "cca64a10-4cbc-4756-a212-a26794795389", "comment": "Malware payload", "value": "50927fb090af93047afdc1778134813f318825cd8faca349365e5e5633809a95ae45793faa56a820fc5e7bd976ef897a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117233, "uuid": "f0107b1d-96d1-45e2-a270-e9f0864bab78", "value": "T1F685815A517CF367FCF1E7AD08926828286F69CA1D259E41A80772532C3FAC9553B3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117233, "uuid": "58ac513d-b8aa-40d9-9903-4cbc9a7b2b35", "value": "49152:bEWOfLWgV4EBbZ/pzgtSsqTeqjcUL5mlQ/6j3edULG62GmaVPw+Y+p+zCGkeWYPg:0H7YsCzMw3ba3SnRNzIQzznHr5M7Fi22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117233, "uuid": "b461d6cf-7410-46e8-87ac-339f819158f0", "value": 1825464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117233, "uuid": "414e1594-7538-43b3-b365-455a368aa0aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117233, "uuid": "2813de09-cd03-4df4-bd93-aa4f2643f735", "value": "alhm.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031e9b82-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104240, "uuid": "9e2bf5b0-8bb2-45b6-b8dd-d55cacd59c6b", "comment": "Malware payload (SnakeKeylogger)", "value": "de6b99ad8b1a266e5e8f4831e9e2c512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104240, "uuid": "15899a2e-1eaa-4c60-b1a1-b1f511d417b7", "comment": "Malware payload (SnakeKeylogger)", "value": "3ce1edf1903d5b6a036ace6a8662598b6ab77649a4e024b95a1062786eca1b89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104240, "uuid": "9140fe34-e79e-4297-800f-250a4d30bb84", "comment": "Malware payload (SnakeKeylogger)", "value": "7422f0fa9aad6f518dc71bf5f8586e926681686f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104240, "uuid": "97fd52ad-f678-4919-8fa2-94f62662a451", "comment": "Malware payload (SnakeKeylogger)", "value": "a66334c5e2a5fac74afaf8dd01a0d753cdad7970aba4d02c74cdb4a3f922bfde49e1ce425fcc91c3c8ec8352037056db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104240, "uuid": "8ba44e0c-1f5e-415b-9ef0-fa8bad63005d", "value": "T11A440221A59CAB73EAAE07F4083439440377567B4327E3DA5AC1A4C7508672189F9EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104240, "uuid": "0195c6e5-3233-436b-8fb3-d918004c115a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104240, "uuid": "3f7e3929-510c-4741-aaeb-2222c9d3ea09", "value": "6144:kY9lSSxmJpPs8gSTe6vitJHGLdSC0JpLO/xDg1w5l5/Tfp:kqSSStsUeWiMSPL0tnNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104240, "uuid": "8b1aa68a-e4e7-40d0-b882-27bc4e1a0539", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104240, "uuid": "a6826de5-4ff1-4e2a-b2b9-2b0fd3078e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104240, "uuid": "59d71a09-2ccc-418c-8d59-c8a6c4b5ab62", "value": "SKT4TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe0786a-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652058620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058620, "uuid": "fe8cfee6-e3dd-4e55-996c-1d72a787f32a", "comment": "Malware payload (Mirai)", "value": "add6ca31a6516dde2bdcebf721857767", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058620, "uuid": "30a57d47-3953-42a1-88ae-31239b29ba01", "comment": "Malware payload (Mirai)", "value": "3dc4575448d1ca5741d284fbd0c5b1257f29261994909fe408e9d201859eb5c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058620, "uuid": "7eb1ff72-1f41-4296-ba5a-6f70a9ac3c9d", "comment": "Malware payload (Mirai)", "value": "b3dd2d8c81045360972b224914590649cc0a2cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058620, "uuid": "addfde67-4595-453a-9a08-1a69456a8e45", "comment": "Malware payload (Mirai)", "value": "3604fbc6e1a87655789afd0bb465e583221f035d1420e53d4aa1735c623c4830791a5dfb877adafddf2c7f4728db57ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058620, "uuid": "b87a915d-b1a3-4eb7-8a00-7bbf5247d747", "value": "T18513F856BC829E2AC6E063BBFA6E418D331163E8D1EF3257CD142B047AC951F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058620, "uuid": "9e711be7-9814-4e2a-9682-d25ea977f4bb", "value": "768:PgiM6rEAqQmx6vkXAbW6GBJJamkHrx1HG4AxDoCerC4acOt9PvYP5b/hHp30JOEg:PgiMmEGmNwbW6tg4ASaBPI5b5es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058620, "uuid": "bf74050f-ce0a-4c5f-9d17-4d75bbb7e15f", "value": 43252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058620, "uuid": "ca30b79e-821c-4f26-82ea-d628b0a3d2fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058620, "uuid": "64d08792-9914-4685-a847-d057cce884c7", "value": "add6ca31a6516dde2bdcebf721857767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cbc220-cfc0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652118607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118607, "uuid": "f95108f8-975e-4c3b-a43d-6c2b2ba9a417", "comment": "Malware payload (Mirai)", "value": "5576698f50305e218ea2e351b9246571", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118607, "uuid": "3c6e8d63-17bc-462a-a3d9-8ea2b7f23ecd", "comment": "Malware payload (Mirai)", "value": "3e0f1d40628768f7c723bc48965761e263c215faac40d11ef230f61dd89ac4b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118607, "uuid": "cfc8051d-fefb-4911-a39c-ff3eda3e9e8a", "comment": "Malware payload (Mirai)", "value": "ebfc0ae6f833e6d25f532e97ddad9573d37be2ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118607, "uuid": "053ab49e-2420-4c56-9a80-646e59d6f0fc", "comment": "Malware payload (Mirai)", "value": "fd530bf40c7ff64773ee87269f40974b3705039e26e0780334c3703080af13135c87be40a4e42ade3c18ec833afe9aaf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118607, "uuid": "84874c24-0bd1-41a5-b107-3bc914b07a86", "value": "T145534AC8A5C3E5F5EC001D79307AABA1AA73E53F2039ED9BD39E25739943243E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118607, "uuid": "31329dc5-9087-4bad-8179-1f35f591c84c", "value": "1536:b5VYYpXIqVkxmxRvXMFnKia7jGKO18Hq6PWRORu0+j/iMAm9:diYpROxmxhXMFnKl/GHCHqlmu5/uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118607, "uuid": "9a065191-e434-40f3-aff5-d143ad76d58d", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118607, "uuid": "fb1de224-8527-4603-813f-af1f9c285530", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118607, "uuid": "4f6cb51e-823d-409b-8c67-08a6651ba153", "value": "1isequal9.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68ed510-cf31-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652057403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057403, "uuid": "ac4b0717-8788-4599-94bc-570f16a658f6", "comment": "Malware payload (Mirai)", "value": "fcae377672f9b459a8078e06b6642f80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057403, "uuid": "528dd2c1-7466-4a4f-983a-5c245a8588c7", "comment": "Malware payload (Mirai)", "value": "3f069c378185dd3ca84fdbfe6bb959707e0f5c0c93f9a923687c5270cfaff563", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057403, "uuid": "79062f2e-0682-42c2-a49b-93db2ab41a96", "comment": "Malware payload (Mirai)", "value": "0af7523466c812b66f2fbd4a53edfca70d2c38f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057403, "uuid": "c631f6f9-0a39-47d3-b2ec-1ad90feb42f7", "comment": "Malware payload (Mirai)", "value": "305eb54b521359ef121110dfe7c30bd91d3c62e6c8ab8df159c2d61203cd6c1a0512b9836499c701db43b83bb2e36797", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057403, "uuid": "5ead66a9-74f8-4c68-b103-715e984c1f54", "value": "T1B5236CC1A543DDF8DC1106F12173EBB39BBAF07A6029EDD7D799A932D841A01E50329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057403, "uuid": "b5efc9d9-fcfa-434a-b0ce-4ffae23800fd", "value": "768:3W8Vw1BBOGSc2Wlo/bvnhwMMPRwE9vZEnbD4dlYybJmiXO+YkX4aP:3LV0BOGSc2Wlo/bvhwMMPSKZEUlYuJmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652057403, "uuid": "c81b965c-1d91-4af9-aa4c-7fd709635f88", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652057403, "uuid": "91939929-d70b-4637-8117-aa4f1b60ecbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057403, "uuid": "6938bff3-3264-4d72-aeb7-5cbd192d4101", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7541be5-cfa9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652108810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108810, "uuid": "3a0c211b-8a48-4585-8283-93729c13c2ee", "comment": "Malware payload (Loki)", "value": "e9b618972ed5d2db2d74bb03b184b04c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108810, "uuid": "dc3a958d-7c18-4218-a48b-94ec961be725", "comment": "Malware payload (Loki)", "value": "40aee3a88d76ccfa868a9111205af6c63d304b3b69f7e385be770dd8ab4e8ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108810, "uuid": "de1c522d-4f72-4b33-8ad7-a678a0ee5aa8", "comment": "Malware payload (Loki)", "value": "71cef54641d169ed371899749b0347108ede9fc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108810, "uuid": "b7da7bbc-7650-4a97-a8df-8df2115f176c", "comment": "Malware payload (Loki)", "value": "6e0654006bce386a8d40a28d81b73d1556edbdfb78db73eaaec5bae09cc00c5fdc420b89a9f191a517576a01b81439e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108810, "uuid": "1b54cc4d-d598-497a-8964-728a1289089e", "value": "T1C1F4D0AC31517AEFC827C6FA9AA82C64A7617477530BA243942315E99E0DBD7CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108810, "uuid": "bcba0fad-1f1c-48e3-9193-cafc2ce60ee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108810, "uuid": "e3d80480-bdad-4f09-a4c7-5c8a4be0cfc4", "value": "12288:Q8x22L2IfZjCPX/5Lkfv6VCFqFsAlwg+e3zW9qRSkx32W8SwFVE9TZUzf+cYR/rp:x22W/5Lsv9MFP+oz5R1N2Wmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652108810, "uuid": "ee8862f3-20df-4d92-8ef3-ff5524cd193e", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652108810, "uuid": "f868da42-44e5-4729-b659-090e001c089e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108810, "uuid": "66e85a2f-5dab-44c1-8010-bed5e2a8d6ed", "value": "orden de comprapdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7221479e-cf4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652069637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069637, "uuid": "69827d01-b4e8-4525-a317-a642c3029cf8", "comment": "Malware payload (AgentTesla)", "value": "93ad10492ab5afba2d571f40df9e9e93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069637, "uuid": "daa1e066-676d-42ec-ae8e-a88d188e7c6b", "comment": "Malware payload (AgentTesla)", "value": "4112b870abe910ca91a7a5a86bff68e6112a67972b61aba3ebae11f65de2ed95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069637, "uuid": "dcb4128e-3103-480f-8813-9620b05a3f9f", "comment": "Malware payload (AgentTesla)", "value": "f7b20b2b045d99f88d198d3df9397ad8c1973d19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069637, "uuid": "40495caf-58cc-429b-8bcc-ee3bf4e0a36b", "comment": "Malware payload (AgentTesla)", "value": "5b072a27eaeac30b633b80ddd97f3dc39503b8529bff4fb1e95498d8c8c2399b3c7c8c6bc53d5d792505e2528ac4d9ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069637, "uuid": "be1c869b-82ff-427f-9eb8-20c8c35ed969", "value": "T1EAC4599CB12071DEF457D4B2C9682C68A691766B431F46039433E3AA9E6D6F3CF11CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069637, "uuid": "30225c41-f6f4-4f81-8c55-295e3e345fbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069637, "uuid": "e6b8c223-324f-48a3-a3e6-b79748dfa31b", "value": "12288:OgjjCJbRc1emz4GBjYVw0W4WoqxN5BGXVvVqQDVnCiclnqNqza6m:OgjjCJbRc1Njl05Wo6N50lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652069637, "uuid": "4857947c-caf1-41dd-9b63-32699f874584", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652069637, "uuid": "818aaca6-0006-4e77-bc05-2acc1b396cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069637, "uuid": "b578e530-b917-4fa3-9e26-a1384def6fc0", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1d1da7-cf4c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652068791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652068791, "uuid": "1da2e112-ba8f-4787-a612-1f8ea7d2eb69", "comment": "Malware payload (AgentTesla)", "value": "c24dcbeada1ea70ae989c2e89e94ab94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652068791, "uuid": "c5cd6913-71f4-4261-be76-d19a6ab706d3", "comment": "Malware payload (AgentTesla)", "value": "41b4934175cd6e5d2de06bbe30db1c1b258f75545a2e5c9b1e2b20d9fa92f369", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652068791, "uuid": "95f56a09-68d0-4cbb-9a74-f48dd74f34c2", "comment": "Malware payload (AgentTesla)", "value": "2b03aea1e5e0a95928b57960a1948c3c7723576d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652068791, "uuid": "dd10216a-7837-4c26-9589-569cd8f711de", "comment": "Malware payload (AgentTesla)", "value": "a45b35f33dc03e16829a4c9af85b794448929ef9fe119fb7dc6c2aa05d1ede3e52f244f6589eff806012c7b390d778c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652068791, "uuid": "96cf3410-87ee-46b8-977d-abd5ae78f34d", "value": "T1B4B4123972B84254E5BA3ABA946303004771E997A622E60D3DDA6CC53933F54FDB1F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652068791, "uuid": "5ea7f45b-14ba-4f0e-8816-67fcc1d7fd04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652068791, "uuid": "cc29aaed-1a02-4d5a-908c-4fe8f3845bea", "value": "12288:1ydzLCUIIQ3vp9zgFwtZgTn0ZYCGuVbjPkWz9q1z:14413vpVgsuM1G6fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652068791, "uuid": "ab1b176d-fe26-41db-8e76-76636db008f7", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652068791, "uuid": "3458f258-27f8-4f6c-9571-f1a82b71f873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652068791, "uuid": "b99c2add-b0b8-49aa-92a4-0e4d45779981", "value": "request FOB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee6dc98-cf62-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652078275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652078275, "uuid": "637cea46-15d0-48da-b601-165df9ce40c7", "comment": "Malware payload (AveMariaRAT)", "value": "02774a127c24a2f2f1b24e24c79b300a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652078275, "uuid": "c006f134-4188-4538-9378-181351991b11", "comment": "Malware payload (AveMariaRAT)", "value": "41cd83f2bc8e750ea88fbe3e517e55ae88359e9655b8a6a26b2924318c2c6a7d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652078275, "uuid": "cf87a86b-ac7b-40fb-bcde-15f51b053215", "comment": "Malware payload (AveMariaRAT)", "value": "f391aa56f68e7c08d005eeb0a8554626a068dd7c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652078275, "uuid": "847d34d1-1ea4-4d33-9d1a-c83ad1f47098", "comment": "Malware payload (AveMariaRAT)", "value": "b574e66fe7654b3fc86840a0b3639bd155d5bbc8663fb032dc60f4b4dcf60e590cf0e682b44a2e5f38f417dbf3b81e10", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652078275, "uuid": "00289ff8-374e-46d8-9df5-0d5570ccdce6", "value": "T16A94124872E85766E0750B7E6072104043B87C57E662DB2C4CEB34EDAAA7F84DF52E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652078275, "uuid": "17a00291-944d-4828-bd7a-7444fa5f9be7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652078275, "uuid": "72262102-4b69-44b0-b15a-6066b3b7332f", "value": "12288:MaefxBqItnsGqsoUL/VEz2bkAHjbBNqBbhfS:MaZynfqqPbkADbfqNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652078275, "uuid": "cd4c37af-bddf-4edd-9885-232e91a05f86", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652078275, "uuid": "7e46a590-cb3a-4df6-9546-beb1a435ac69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652078275, "uuid": "6b890921-1ffa-40b4-9fbd-f71f36c322bd", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.16973.3286.27646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e539db-cf89-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652094928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094928, "uuid": "cb2e1be8-5fb2-47f5-a948-cd27d99b51de", "comment": "Malware payload (AgentTesla)", "value": "459745fa791c6e63c98eaf9f8f4cbcd3", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094928, "uuid": "bc1967ac-3bcf-459b-ac95-a8561ed3d595", "comment": "Malware payload (AgentTesla)", "value": "4254158f9b148912ce76c09a33e9f40af66e40a3893dbfd8019c774ab5662fa6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094928, "uuid": "6c8859b8-2580-4b08-aabc-64b8630c9505", "comment": "Malware payload (AgentTesla)", "value": "cfa58e037a4dcfe52fe8bb29169c07d783a7a568", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094928, "uuid": "010e8e77-dafe-45c9-bf87-f70d8da1a4be", "comment": "Malware payload (AgentTesla)", "value": "ed81a1f9493bec42ff8caf6eea2ac01568f5a05882a6a91f7943aafa4641ae5e7ac78c0aecb08101f0c11f5b553fe64b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094928, "uuid": "25eaa526-41df-456a-8380-4276c8f11137", "value": "T196A423A5DFDDC42FE7DECE4A4C186132343E8D88E8E98F91BC52F3498573246256A613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094928, "uuid": "19f1773d-dea5-41d6-9379-4412b6e34d23", "value": "12288:fiyZMhW9gZDIZv8Oio3LdvxHjCVonsHfAeZWvz:f12WB/Rv9jCVH/Amo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652094928, "uuid": "e1617356-365a-44b0-a3d7-21702e385316", "value": 492353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652094928, "uuid": "94e5c5c5-5365-48ca-8dfb-db6a51518586", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094928, "uuid": "e2f3a56e-d2cc-40b8-a36c-5d66e3fedc85", "value": "Inv,Delivery note.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaad631-cf5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652076308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076308, "uuid": "893dd04e-5386-47cd-8744-32064bff822b", "comment": "Malware payload (RemcosRAT)", "value": "3e974bea23a847c95bbab2f99b9dffa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076308, "uuid": "976e2cc0-f0c9-489f-b48e-077a7c768fb3", "comment": "Malware payload (RemcosRAT)", "value": "451ab9846f3c63a6b5f2e25ab5f58bb4180cf414062f52e280bd98eafea81963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076308, "uuid": "9f09203b-f1c8-4694-9a56-699e06a96ffd", "comment": "Malware payload (RemcosRAT)", "value": "a24d39b29dc31600fa9b51567d7790c4c3e7a0e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076308, "uuid": "475c6b91-7042-44cc-b848-ef41ec81fdaf", "comment": "Malware payload (RemcosRAT)", "value": "14db3a4cd436a50525c6d18d7a49f384cb0519377c76cf6a1278d580bef65848bce797e96d76a98e2848fec662818b87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076308, "uuid": "4c99f6d6-0a1f-4202-822c-3d5c02ca1128", "value": "T1CFF42315F6EED212C8F5573EC063628122B02C5BA912DB1C1CD6A0CABC67F5C9396F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076308, "uuid": "68a47181-c830-4b74-921d-52adb25b33bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076308, "uuid": "9e6296bc-f8a4-4ddb-a046-cf8ba378ee5b", "value": "12288:BpYBWnCC6SJ9pEgqulxZUBjBpWkabq4aNDlxATm2dZki1JJG7t+:BpM69pEgqulH2djNDoKIKMms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076308, "uuid": "b537e404-2d0f-4091-88b4-d122c5f6f59d", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076308, "uuid": "c1f2fb76-8185-4a94-b6b0-a6976bc8bd6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076308, "uuid": "2b8c80d0-a44c-4bc0-8e6f-b0a6de81c359", "value": "ENQUIRY 20220509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923e5a0f-cfc9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652122519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122519, "uuid": "2b42bef9-f36c-4406-ae73-92cbf8132f3d", "comment": "Malware payload", "value": "6cc78f2df0f8c52842ff1ad296907464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122519, "uuid": "396847d7-3710-42cb-9776-99e779ed753e", "comment": "Malware payload", "value": "45aa8efb6b1a9a0e0091040bb99a7c37d346aaf306fa4e31e9d5d9f0fef56676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122519, "uuid": "1f4db17b-f050-4b40-abac-f81ea19bfb3c", "comment": "Malware payload", "value": "f53016812cd8f0c2de87f983fbdd2388de82db91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122519, "uuid": "3f2d9aa7-37ec-47df-8516-46845e42f6ff", "comment": "Malware payload", "value": "313deb27c0a496aae4dead4e600d7cfd5ad2273f3dc1e4a5804f98055192d7a62929ea4f74fc61eff79e904a6f9ca68e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122519, "uuid": "9b81c9b8-d75d-4f6d-ab74-940a188edde5", "value": "T102C6E055B21D61C2DA78C0387493DB322C3472EAA7396FC723E199A55C91BEB7BEC140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122519, "uuid": "9ed1d2ea-ceea-4726-aeb2-ebf5e15a3ea9", "value": "59e16a2afa5b682bb9692bac873fa10c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122519, "uuid": "f1288aa6-01b4-4bcb-be49-31ff531ba4b4", "value": "196608:HqXa7c9ZfzvagPMbyoSYb34Q80LB2A17SQXlDQcF7d:37cZfzDEbyHYL2A17SQX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652122519, "uuid": "ccb129e9-8fa4-4b44-ad45-885e307693b1", "value": 11793408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652122519, "uuid": "2f805f74-8670-46e0-9868-926e3836871a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122519, "uuid": "662e7139-3f29-4873-b0b8-8a0b915c0d66", "value": "mountdisk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d950f4-cfa2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105877, "uuid": "e3aa1e4f-54dd-45ec-9fbe-28bb8690ad27", "comment": "Malware payload (Formbook)", "value": "0d013645848118578ec091ccda6e0b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105877, "uuid": "10102cb4-1386-4002-bcc9-384f58dc2e45", "comment": "Malware payload (Formbook)", "value": "466c633e1e137b92c883a26a147275a6d90d538e6f87b28c70089d7d30e8ac3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105877, "uuid": "0b351e9e-5874-47aa-915d-4b799d607c96", "comment": "Malware payload (Formbook)", "value": "ac3f89ec278b18635e359d676ddba0f8d542913f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105877, "uuid": "c6cfdcf6-4931-420c-9274-3a7d758b186a", "comment": "Malware payload (Formbook)", "value": "f187b4c3bc4cfa41ea9ea6341872569567ebf5a8507816f32d845b557ba6360734f0d9c26727478fad54ccd26e311b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105877, "uuid": "dd089f64-1025-4a04-a951-0d8fa369125e", "value": "T182441285A6F0C467EAB371721D7BA7920AF9CB2531D25B1F1BA06E4E3C36642810E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105877, "uuid": "a8c68e8d-5c19-4dfd-a723-07b648e7f0d6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105877, "uuid": "c5665bae-01fc-4ff4-930e-ca6960047586", "value": "6144:HNeZmYsm7dtTz7xR3/p7HseY/5P9KzEbuEYd:HNlFqHv7xRPp7Mee51KzbEYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105877, "uuid": "c2c2cd41-efb3-406f-921b-66de119a37c4", "value": 254471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105877, "uuid": "90100520-c49b-458c-98fe-73ef6e722d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105877, "uuid": "c0e68a38-6e18-4c83-a959-b80af0257f76", "value": "too666654321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d812140d-cf35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652059070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059070, "uuid": "1039bf64-b01b-4a4d-ad94-4ba07a4f095c", "comment": "Malware payload (Formbook)", "value": "985b93a87d4baab2ffb35755c335e263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059070, "uuid": "033f4dd3-037d-4574-a94b-d8d86520b334", "comment": "Malware payload (Formbook)", "value": "46864364581f4a18b628a1b68bfe231d72f4f871eaa712c1c3150cb01c65e6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059070, "uuid": "a7ee8e24-3364-49d1-a0d6-9150449dc783", "comment": "Malware payload (Formbook)", "value": "18c305201980cb2ee6aebfbaae4b3f9ce7402b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059070, "uuid": "8551d2ff-4f7a-4fe9-8047-ad0bbaa12bf4", "comment": "Malware payload (Formbook)", "value": "4bfc233f0f9043d618c230a4748edd80c80dda5710fdbd4a9a9f04b0427cd6debf4dcd72ecd6480b5609eac9a463301c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652059070, "uuid": "53d0d556-e602-4860-9787-949d081a708c", "value": "T1AFD4011412A69B32F7B933F6179446C013F63E5FB532F295BCA122FEA4A2B480954F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652059070, "uuid": "70f4afd8-d741-497c-855f-2f7bea240cf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652059070, "uuid": "3f767c2f-716f-412d-a1a9-1c56a054c1f6", "value": "12288:A/2L2Ih02L2IaISU/WebTLaTTz2xqVl6GUZe6v0axNvu8:+2E2kuWePLaTTz2w7mM6v0MRu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652059070, "uuid": "1fac8861-67e3-41d7-b878-e84f2e3115ea", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652059070, "uuid": "14faf940-45dc-4213-aa50-c48ea0024e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652059070, "uuid": "65a6462f-652d-461e-a142-205bc9085ac4", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709c1849-cf5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652076935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076935, "uuid": "85fb0a5b-28a6-4ebc-aac1-b4a8b2b91eef", "comment": "Malware payload (AgentTesla)", "value": "0a896166a4f416ff8e569367bd8fb31a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076935, "uuid": "7877e2fa-43e2-487f-848a-8c2cd4c974d1", "comment": "Malware payload (AgentTesla)", "value": "46f580c68f93b12d076bd6f5b4e3b7d034b88b5cb90d507b90426ed99bce1dd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076935, "uuid": "8933b29e-e211-483e-a9ea-0a20dc4b7a08", "comment": "Malware payload (AgentTesla)", "value": "0150e6496f0290c3cb351cd97c18df8d385cd708", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076935, "uuid": "9bd1a21a-cf83-41e7-950a-e9439e4de886", "comment": "Malware payload (AgentTesla)", "value": "62424ef7cfe6247893dc9869872596a1349af29ced4f52281f78cb514ce37c45e05bcf3cf54d29e0eebac7c6cfd403d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076935, "uuid": "7b223dcc-e20a-4ad8-a592-37987a620450", "value": "T1CCF4238AF597634FE4A277A20B8B362448F66B242B5477D072D79C7C8646091BC23F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076935, "uuid": "1d9ee763-d42d-4af4-a8aa-368c2dfc74eb", "value": "12288:UBj9sT6bGBDs9pVyl1WaQ0lsHGe9YGbI5d18S3MT3R40ufH++9hksMsnvFSk:Up9/GFWul1WTdH1C5dCS3eq0KnvF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076935, "uuid": "a47c53e5-b309-4a3c-9a52-4bb9a3a7c2c8", "value": 778525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076935, "uuid": "8b9fdea8-39ed-4fbf-8766-7028f5b4a57c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076935, "uuid": "b7c390c2-c5bb-4fa9-a02e-f1771e9e37df", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f71ad04-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Pony)", "timestamp": 1652058358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058358, "uuid": "9bbdb83f-75e0-4a1c-acec-4eb3a7fc2994", "comment": "Malware payload (Pony)", "value": "2126e1141639d3f1c212eedd90e42411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058358, "uuid": "45d15bff-0e38-4dc9-a075-ca53ef1b0519", "comment": "Malware payload (Pony)", "value": "4826e3b7b75346cc1e5f8749b64c2fc157b8a6ea9960443c2f673c0755058b22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058358, "uuid": "bad0c176-e053-442f-ac3b-b248b1ece7e4", "comment": "Malware payload (Pony)", "value": "7e53037d6156a8363d3348c20be1525a816344a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058358, "uuid": "92859ae4-ea0b-400b-8ffa-2e75e2ee1d82", "comment": "Malware payload (Pony)", "value": "2860ed9111b1f54b8cd465af8aae0a99a74a56f3ac712fc1f01c0c7edef831bf89b331262f65bdfd4038608b9a664036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058358, "uuid": "92b96f75-69de-48df-8dd0-9c23a7605eb8", "value": "T149F3F602F1B4F4F1C4610975BFC403BDB3AED930B43919AB9B8C3446A6F66D5AB075A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058358, "uuid": "4298101c-6a88-429a-8afe-a1b103390a69", "value": "fbab3e022f0aa68f4af07dff0d4cfb9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058358, "uuid": "8ebc41c2-81cd-4c11-bc96-69c51837dcf3", "value": "3072:WoLb5m658O9OSlEK7Q9IE+uMl/cgW8cmNdWig2kLWWHD9KLZ13eULuuHnRm/NdX1:Wc1me59On9IE+uMl/cgW8cmNdWig2kLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058358, "uuid": "cb81cbce-be4d-419c-ba01-2f3e07219d68", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058358, "uuid": "f5eb9fd8-dfc4-4344-81c6-749d56dee99c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058358, "uuid": "94f7eaca-dd14-4c8d-a07d-453d853119db", "value": "2126e1141639d3f1c212eedd90e42411.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b0d12f-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652058638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058638, "uuid": "16e51394-f7dd-41b4-ad4f-80d905d39426", "comment": "Malware payload", "value": "11646aafdcb21eee49835ab4ac1c9785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058638, "uuid": "7eeb92a1-1a8b-4b11-933d-ea803467eb45", "comment": "Malware payload", "value": "485d38be3a37c056cc429fe46982102ce013c239321625ad300473267c2a3778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058638, "uuid": "cffa0152-2fce-41db-bc0f-14e8f7230f05", "comment": "Malware payload", "value": "e923ff7804b9a558ecd7399a0ebbd080fd23442f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058638, "uuid": "3a941bb1-4347-4de5-b484-279013b2bbd3", "comment": "Malware payload", "value": "a9a6c4f82b8c419f0723fda55533c7df922089247507cec8fb7358410b85c571ea4cac71a2ca9f9ddc7e2c8cd7bc4064", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058638, "uuid": "d43f81b1-2a5e-43d9-8059-f417cbe085cd", "value": "T1F9146B246190F431E8B70435F4EA96F4596C7A7067A88CFFB7C58F2A4A352D2D131B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058638, "uuid": "d72aebbf-dace-4ca1-9eaa-97293baf83e1", "value": "951c802a01f3e0abf3e63c1464ff7659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058638, "uuid": "dad5d492-cca5-4758-881d-0e9818324e46", "value": "6144:QBI90YmmxcFsHymfAscaVK7nMi+StudrhCrU:uI6tmxcFsSmfAscaeMAudrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058638, "uuid": "ee4e553c-56a9-4efb-8b60-99f2fc27b576", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058638, "uuid": "ca999827-c978-4c42-9600-64bd2eee00f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058638, "uuid": "a6be364d-1fa1-4b0c-b9e6-3afbbba4b502", "value": "11646aafdcb21eee49835ab4ac1c9785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ce98d3-cfa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652106145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106145, "uuid": "c82f896b-529e-4618-8649-7f33064d718a", "comment": "Malware payload (GuLoader)", "value": "4f1d2777f28dcdfbe8e4e94fb73c1ab9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106145, "uuid": "1acb6ca7-059f-4c25-8ec3-23688bd318de", "comment": "Malware payload (GuLoader)", "value": "488cfaeffa8feff5a491c4a518b5e87a3105ce009aaa0e57dc517ca0889c38c4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106145, "uuid": "14155e3a-35d0-4a68-85f0-743ffd0c6741", "comment": "Malware payload (GuLoader)", "value": "7281df55cf3bf0dc8baab408f7991e0e6d414ef3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106145, "uuid": "64fda6d1-afa2-4631-9828-55b922081793", "comment": "Malware payload (GuLoader)", "value": "6bba8ec0f01c0a544744d8e1d77102d621e1730a50e5c2da9c2fe523525dfbed75f622aba4f3c0deb27e32a00c04f0cb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106145, "uuid": "b3bdba7b-10bc-4a29-bdb4-53854f726702", "value": "T15882B02DC601A02DEA59C93DD1ED21F3F11D0206A3A5A96E3079FDDF8944F6347516CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106145, "uuid": "76706f3c-ffc9-4c58-97cf-19bc09790c6b", "value": "384:t7ttHXaSyKB+AJu7lSO1tvvgzYM9i84YXavgT:1HHXadi+AylSqvo934YXaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106145, "uuid": "c2226bda-346f-4d28-b0be-3f4bbf728bc0", "value": 18590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106145, "uuid": "dbf82727-6057-434a-ad41-752fc121c52d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106145, "uuid": "b9b3c6e5-b8e5-471c-8890-20bb4b6a37d2", "value": "bm2.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbdefb4-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105167, "uuid": "40b9be4d-1746-420f-961f-2e48fd83c681", "comment": "Malware payload", "value": "4312a9bfd8038a197009951c8afa6f9f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105167, "uuid": "d4bf7952-e47b-45a9-9faa-e81458f7881e", "comment": "Malware payload", "value": "4974b1d1858d568da7af5ab5b24fbf2966ab4a8f237f602272cc39ec832bcbcd", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105167, "uuid": "9499e545-4fef-4cf4-ba11-fb565037f78e", "comment": "Malware payload", "value": "0a61cc3356c854ce42a600d0d1504f75b2319cc2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105167, "uuid": "bb986387-d34f-4648-a8c8-e64118dd8f61", "comment": "Malware payload", "value": "940ed47827c451f9da299e25b59cc44fa87cbaf419439f9d128b075dd944d659e3d6579acbb7f12a3b7a4b11fee1fc12", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105167, "uuid": "4c167860-9a27-4ddd-a8de-9fa7b055ec89", "value": "T124241210BF34A9FBD903467B75462A383372DC8E1651AE5D9E11FCCEA4B1A50C3C64B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105167, "uuid": "0fb646da-e380-4997-bf85-f70df04dd7a2", "value": "3072:d6n1DBcR1HxMUJJ5RD5cU25YbSq1GiKjR/y3Eu6Iv+0a052dhS:8n1N0fRDXbgjR/y3EI+0a0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105167, "uuid": "363997ab-e87d-4b59-b5bb-d4413db41811", "value": 211608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105167, "uuid": "9c7eea27-a9bf-414d-bdf3-6bfca17a81cc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105167, "uuid": "4e81e7b9-ff1e-44a0-a50c-05fdccf090d0", "value": "Revised Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdddb653-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652110593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110593, "uuid": "fb2d227a-ed64-42a3-b19c-49495eeb50d3", "comment": "Malware payload (Formbook)", "value": "0dc0b80701533e0c280d8ee4827c87d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110593, "uuid": "e7c9610b-0277-4e51-9950-533b02de68ce", "comment": "Malware payload (Formbook)", "value": "49c0c4810d07a4328281b5d8e63d51be03732beac6875589c5c4b800c81e1f8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110593, "uuid": "d32a8e02-9874-4fe3-b047-bdc33af0a101", "comment": "Malware payload (Formbook)", "value": "c2b884b2f65717e9fc90e282f8d34d07cb4f7ca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110593, "uuid": "be5f8f1c-6756-4f47-8f2b-d5e8dc7c59e9", "comment": "Malware payload (Formbook)", "value": "a9a173f6ca0484e363c6f3f086c5a9c9c46b53b19979907323c9eb2d016e8acd6041ae37c0b7feed3af28300821ed054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110593, "uuid": "37c137e9-2e77-4647-bd50-c69cd8a6e09b", "value": "T1E73412946FB0C877ECA267761E3D5727BFBA82920420471B0B303C5DBD65246BB2EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110593, "uuid": "1d5aecd2-b863-4f0b-8d24-24825c723144", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110593, "uuid": "27b77ef6-b1d5-46f1-83dc-0cbba7b816c6", "value": "6144:HNeZmN62b4YAFsOmK+Lq5vNaCy4mBwinvS/gS+LJj:HNlGf+O5vwCyyu5S+Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110593, "uuid": "dd452ebe-a66a-4f05-96ea-c42e123e8456", "value": 232541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110593, "uuid": "7643e085-f33a-4d75-91aa-ff03766c3520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110593, "uuid": "7ff868eb-9b91-4ab7-94f9-5f854cab40ca", "value": "0dc0b80701533e0c280d8ee4827c87d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1d00ca-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652107285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107285, "uuid": "dea36219-71ce-469c-82cf-e03162ee3c7a", "comment": "Malware payload (Mirai)", "value": "d63f2cdac8c16fed4ca060372c36e7b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107285, "uuid": "d07f5d6d-7223-46ba-b3b9-f91476e25412", "comment": "Malware payload (Mirai)", "value": "4a7983ea3b412bb36bade553018ed011866d9820706ca047f1dc32ea1b60c7f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107285, "uuid": "602ece48-2d65-4cf0-9ce6-daee909544d5", "comment": "Malware payload (Mirai)", "value": "6f24b223dd309fedbf82bb7f859c871a465563af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107285, "uuid": "22090b24-9b0e-431f-838c-e7c56da171a5", "comment": "Malware payload (Mirai)", "value": "85edc2003b4b4709a20b8142c5893d9ac9373b5f8b35970451cc46845f3d6923cce938ee2f499689a19d02fab7524943", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107285, "uuid": "1b04aa47-09ee-4923-be43-9575c229135c", "value": "T1D5B2D060F8269903CE7EFBB41EB9D99B33A59C5F3713FAC39CD05782042392654806E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107285, "uuid": "13cd591a-51ca-4f11-a2f8-91878b1445cc", "value": "384:QLl0dUqDa4Ejc3CGSwostEB+Pv9G2Ca0YjXL8briXTLzqu9UdLvymaVkHZlxrmbh:zdZDJT+wostlPVG2C8XwbriXTLzTaoVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107285, "uuid": "4bbfa76a-e30f-471b-ae3a-f0c8d7ea75cf", "value": 24168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107285, "uuid": "e2311e75-9b2d-4c83-b9f9-acf1a33af272", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107285, "uuid": "64c8c01f-87c9-476c-a4aa-7d55b5f4f296", "value": "d63f2cdac8c16fed4ca060372c36e7b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144f132f-cf43-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652064755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652064755, "uuid": "3e2b54ea-409f-4d10-a45a-5fcdb71a7cde", "comment": "Malware payload (Formbook)", "value": "3eb8bc0f34e02f7723771648a4c63f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652064755, "uuid": "44a5fb69-fa3c-4eb8-84fd-563d1069c9cc", "comment": "Malware payload (Formbook)", "value": "4ad6f22622ee8d0479488a776ff027e1ee66acfead8f6de0a39c6db6abba0ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652064755, "uuid": "dc17eb04-dab1-4d6f-81fd-b6f53c98795f", "comment": "Malware payload (Formbook)", "value": "d58555fbdd0e2247cba7855e37338697d7947b2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652064755, "uuid": "1405fb42-da33-4b9d-9bee-034ee42e35bd", "comment": "Malware payload (Formbook)", "value": "3bdfec1ab7e4d68fab94c36ecf0854bb2f7892a97444b05324f49dc3a21cb881fe478b267cc08d391e8073119d7b780a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652064755, "uuid": "08dba916-c975-4a40-9ea3-5c1ef69f37cd", "value": "T1D944121416EAC0ABD9593F7146255EB8736A7D29EC29420F37207F687233B6DA4CE350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652064755, "uuid": "81938145-439b-4490-aaa5-6c7c6dfd16af", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652064755, "uuid": "e62d92d1-b1f0-4815-853c-4e34ec0047b8", "value": "6144:aNeZw4E9Fm0/hnRNl9G9weEoLbrs8Z/U/:aNL4sFm2TvWPto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652064755, "uuid": "3fa4a0f6-6f81-47ea-8422-90c555a1c641", "value": 266038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652064755, "uuid": "a4ef91f9-acd7-409b-a88b-71cd0a069105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652064755, "uuid": "d19e4c6a-3a5c-4578-bafb-6931e9b6f9ec", "value": "Payment_PO21-00460_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cad9cda-cf47-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652066540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066540, "uuid": "9ba92f52-b7fa-457d-81aa-6ecb4868667d", "comment": "Malware payload (AgentTesla)", "value": "a42e21f52fd1f78f98ba16a20ce311c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066540, "uuid": "2ca2828e-c879-47b9-8313-d777bc310ad5", "comment": "Malware payload (AgentTesla)", "value": "4b3b8f1f6ab69340cea4c78f21cb691e6efdb3ede2973a6315e947b281ea25c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066540, "uuid": "1d918bb8-d555-4123-a58e-778b84bc4806", "comment": "Malware payload (AgentTesla)", "value": "4060cd84567213393793efcd6179bff3e7280069", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066540, "uuid": "69cbc810-3cb2-46fd-8819-eecdb7bca460", "comment": "Malware payload (AgentTesla)", "value": "c7de33f6f98477a493fd53631b74068a447d66f4f480b66bb429c4d4c43581cbf796c9f39778e13224e154730eaf13e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066540, "uuid": "8634e980-4629-4213-aea9-f3fff66e213f", "value": "T125C46A9CB12075DEF857D4B2C9686C64A6A1776B430F42039433E7AA9E2D5F3CE44CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066540, "uuid": "89fe11ab-560e-4f91-a5f4-dce470ec46f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066540, "uuid": "a1039b3a-b8a7-466d-865e-e2564aead5c5", "value": "12288:dgjjpDJ2nVeceWFZhgqa34RSYMHoTs58AofujCdOXY2eUeJm2rbYUXBAsGc/5Sxa:dgjjpt2Vechuqa34WIYepfICkY5Uah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652066540, "uuid": "acf99362-2a61-489a-b0d5-76e59614e030", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652066540, "uuid": "72935f67-d4c6-4bb0-aac1-b44fc1b5a571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066540, "uuid": "e9d8d2dd-6388-4d72-af9d-005b217ee0d6", "value": "SY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2fec06-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652104305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104305, "uuid": "c77e90c5-5276-4d78-8f1a-3dff9cbd1090", "comment": "Malware payload (Smoke Loader)", "value": "c8cc8d15bd541f737ee3d5c598c60ee3", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104305, "uuid": "d26fbaad-1fa0-4016-a964-2b86a55b43c4", "comment": "Malware payload (Smoke Loader)", "value": "4b72add7c100daa37f81ae9f3c0050f0e577bfacf6a3706d8c20119ee7fe7174", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104305, "uuid": "8a3d9607-2cfb-45c8-af04-68800ab620c5", "comment": "Malware payload (Smoke Loader)", "value": "70bcd0049c64b7f4043dfdd1c97a61557a93b2ff", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104305, "uuid": "1cbdfaef-7606-491c-ab77-a800d97c93cb", "comment": "Malware payload (Smoke Loader)", "value": "26bc3b1b61611ab544b925f810428da999a8c0a582e219d010b833fa0b643fe3ccd4af8773494994996a03f330bd6753", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104305, "uuid": "66b94389-11dd-423b-8d5a-039338a1c817", "value": "T150449F00AB90D035F0B716F4497A87B8B93E7EE19B2491CB62D52BEE56346D4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104305, "uuid": "b38167f3-7f24-4e6a-8df2-47f5636f1bbf", "value": "162bfa83d7bc4555a077d42813a965ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104305, "uuid": "845a47ca-167c-4fa1-8730-35cf4a308d1c", "value": "6144:M6fNsEo3wkW7OxGYTEkeynS1OE5uCxUhQNn9YkOzo:N1gAfyxGYbepbfUm9Y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104305, "uuid": "68071c57-558d-49d5-bdf6-0395cd61faa9", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104305, "uuid": "a7b9784a-99a3-431d-ab8b-18336eb3e219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104305, "uuid": "16dc1c6d-19a7-4a8f-8e26-9374053c3e85", "value": "c8cc8d15bd541f737ee3d5c598c60ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4e3130-cf8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652096173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096173, "uuid": "dbbedd75-4106-418e-8f65-32648f0aaf4d", "comment": "Malware payload (SnakeKeylogger)", "value": "26543976eff5248cf93ce1640a0c7f75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096173, "uuid": "5a62c72c-41bc-4f41-927c-a3979995656b", "comment": "Malware payload (SnakeKeylogger)", "value": "4b9666a5286a5c77d51d473e9984ef8469d800ab64f31bcbadd289b03dd16d15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096173, "uuid": "17f8f4e8-5cab-4e24-8d6b-c77d2479aa23", "comment": "Malware payload (SnakeKeylogger)", "value": "1f29b99ab1d0b25e7c09d540a64be8f35ff0afe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096173, "uuid": "19d5af27-fc1e-42a6-a91d-e0eec23a711e", "comment": "Malware payload (SnakeKeylogger)", "value": "9b625eae036c140c5df85456386416f5c3c046f944b9c76ce2149cc46d590a5ad7351e37513ea934366446b29496cab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096173, "uuid": "7018c457-92a9-4720-8342-7d26329fd6ba", "value": "T19EC41208BBEA4773DA3507F22255929447F73D6DB423F65A6CE922EE18A33416110FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096173, "uuid": "fe9d5717-5b96-4574-b933-c95b3c2e60ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096173, "uuid": "1949e962-4927-4d0b-b8b8-f83b84609a61", "value": "12288:B4v02L2I3UlfsiWRoHvBgwmKCVlRkxJC995EjmT6Q1P2wR1S6:b2dUw+vCHtcHTmGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652096173, "uuid": "9776e45a-2039-446d-8306-881e1099be90", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652096173, "uuid": "8066b442-2f52-4cab-b42e-7355742eed06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096173, "uuid": "9fd67a7f-841f-4549-897e-d12fa429a04c", "value": "Phosphoric AcidPR 120006486PO 120008190.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b38ee9b-cfd0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652125540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125540, "uuid": "a73d24ec-697f-4171-9a3c-31359dcd4b37", "comment": "Malware payload", "value": "485b65ea3f28d1cd17cd4339662e048a", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125540, "uuid": "1f905d1c-0487-45d0-aec7-2d3e3b2acc43", "comment": "Malware payload", "value": "4c9ffef418385fdd0aa0e6ea1c0e29f3a7a4af51fbcfd011d0797d6e62c8ccfe", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125540, "uuid": "ccf5766e-b42f-4e60-8d39-f6e58cea232c", "comment": "Malware payload", "value": "13da23476ed7c8211fa49380176eabb17c1a9408", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125540, "uuid": "a2e4f5ad-3192-49e1-840a-1859edcb05d5", "comment": "Malware payload", "value": "c6da690ae4e2fe8c9709f394e6981509cdfee37a3d8a22486fd6a9ca7ee94cdb36b081ae180e93e480aa82c49c1dd1cd", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125540, "uuid": "7b35eaf6-03c1-4072-931d-d342e97516f0", "value": "T198556DF85F99284CD83BD8199597BC7E9B8834535B1EAFD03717E8122276308A92D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125540, "uuid": "3e676001-c593-4836-ad21-cbb1dad6a436", "value": "66356a654249c4824378b1a70e7cc1e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125540, "uuid": "e0aa184f-834b-4f08-addc-c606c2914074", "value": "24576:ZdyqGb318EyKM8V/kQe2SvRjRlOeDE20qu03dw21HKE4m6SlT0NxhPivyie9tXLJ:vyqg2x3ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652125540, "uuid": "e0024f6c-076d-4514-99b7-3f6b7716f421", "value": 1394688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652125540, "uuid": "223e9639-fea4-4540-8916-1ab3c88c4d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125540, "uuid": "6565f310-b501-4dd1-a7ed-ac5015e9fd15", "value": "ramest.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173a3d84-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652109857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109857, "uuid": "311e241b-9be6-4862-a640-f8dd02f2aacb", "comment": "Malware payload (Loki)", "value": "8fd789dd2cb93be5bcc0cc555e3d0224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109857, "uuid": "0cc1cb6d-9d3f-467b-9309-4b611487ff9f", "comment": "Malware payload (Loki)", "value": "4d05ed5d5deea64d74e00dd818f36afe2b7fa7effe971cab1aed950cc1976871", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109857, "uuid": "b80e74d4-3db7-4697-b90e-cd8289cabc79", "comment": "Malware payload (Loki)", "value": "222c6e707d04977c854d286962da08fd7e5bd688", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109857, "uuid": "03e61425-781e-45a9-80a2-4910bc39196f", "comment": "Malware payload (Loki)", "value": "eb98cb78ba790080f8ffc3817732addf9f3c9f2437b845eb1c4ecab4d48af1eebddd9039ef3278f915477a309798342f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109857, "uuid": "fa08ca86-5192-420e-8de0-a77516bde836", "value": "T1FBF3F16062A4E437D4E30F3119366BB36FFA96661530DA0F17A4AF9CB8726C3891F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109857, "uuid": "2963e3b2-1055-4402-8500-b271e613007b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109857, "uuid": "e0f87682-30fb-4161-9b72-2d2e2b04daf8", "value": "3072:l1NjcVVnLpPunbICBJO0Dk3TTPezPQiYFUy37C/Ul1RHF3ucWuECeyhoDWgLo:HNeZmg32zKCUl1xwcWkecoDW8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109857, "uuid": "cdfe8e61-f6bb-4a42-ba2f-5efeb0acaae0", "value": 159209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109857, "uuid": "d6f96064-2ac2-4797-8771-3e40e123c629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109857, "uuid": "46de90a9-afb4-4601-a4d1-90123d3f98c0", "value": "8fd789dd2cb93be5bcc0cc555e3d0224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a196772-cfc6-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652121055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121055, "uuid": "dbd00334-5e18-4b0d-a1a4-1a98e3c6fe53", "comment": "Malware payload (DCRat)", "value": "1030a5b95d66a0b6b16c485d64ddb804", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121055, "uuid": "8339ffe0-0a28-47c1-bf65-3c842a650be4", "comment": "Malware payload (DCRat)", "value": "4d1f6c0ec7cdf61fe8d7527b6c5e2a9e0fdc0bcda2db4a2f34be3e7ada18bb9b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121055, "uuid": "be875f07-e4a0-43a0-a974-06ec38e1c616", "comment": "Malware payload (DCRat)", "value": "9c15eaf94c511f6fb57978119a638a74471e6279", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121055, "uuid": "bb9ba514-4927-458d-a773-38dea605a515", "comment": "Malware payload (DCRat)", "value": "51cb510d3c7b565b39aa1cad4365772e4834603fc9c05b219fa96c657b7bca0d55b9a827c496a5ca54bf9be8bed570bf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652121055, "uuid": "fdfcbe6b-a7c3-46aa-9d87-d4c6fdd6c439", "value": "T1633538027E448A12F0141633D2FF594483A4ED412AAAE31B7DBB7BAE15117E77C0E9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652121055, "uuid": "543573ff-7f43-42ab-b9ba-05fb4a532236", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652121055, "uuid": "f7736313-5ad8-4949-97be-6193a6286d15", "value": "12288:DQpqRO6YAcHsnOIT+QeIYFauxgFy0DYvxwe1osM6yB19ESZin35u8W/Zer1yczv8:DanAoGvZQFUl631oswZ2y0rUczvdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652121055, "uuid": "6dc2b719-3661-4a7e-8131-f41a8e04c191", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652121055, "uuid": "6333cc77-1484-4753-a799-1936b5b8ca15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652121055, "uuid": "69687601-8190-47ec-bf85-ea8474a839bd", "value": "1030a5b95d66a0b6b16c485d64ddb804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeb36ef-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652058592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058592, "uuid": "a9f97b83-abd4-4375-806a-12c606978c52", "comment": "Malware payload (Mirai)", "value": "7b3c3fe2032a9b22fbcd4a679f03c948", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058592, "uuid": "1cfec5c7-3718-4f13-b2cc-5f3644b903fd", "comment": "Malware payload (Mirai)", "value": "4e15837b005d7b7e229438fd5f37c8e5daba110290ec063c1e2e952771c92132", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058592, "uuid": "9ea9e66e-65c8-4012-8e94-13b393fe90c6", "comment": "Malware payload (Mirai)", "value": "02163cd6bc793614a31f73d7b93259bc32d00edb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058592, "uuid": "75a058f1-d66e-4313-a745-4d71b168ab75", "comment": "Malware payload (Mirai)", "value": "313a946ab9bea4016c73e6828d2de796ddba78a5a7d95ebc4149ca469f6d3a69445cfa6d460245fcc48f70d4c2556df4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058592, "uuid": "90d84e4f-1652-4c32-9418-368fe066d8e5", "value": "T140232B42722C0A47D1A65EB0393F0BE093BFE99124F4F6886A5F9B468535E371186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058592, "uuid": "2db07d5c-d04d-40b8-9cef-c7018e97bb66", "value": "768:m0tc4n8iAxt1V+B1cNsG/Res7bfGMmD253nhhVLoxhoXRhe7:BvAxt1V+BaaQWu1i+XT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058592, "uuid": "147fd76b-88f0-46d6-85f4-c993d404d4d0", "value": 47644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058592, "uuid": "ce565918-2132-4822-9f3e-1364edf1cbb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058592, "uuid": "34c8d3e6-b9dc-4e02-8f36-0de0dee7dfc2", "value": "7b3c3fe2032a9b22fbcd4a679f03c948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94efe356-cf7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652090740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090740, "uuid": "79e0ba47-4d15-4fad-8d2c-1e673bd62472", "comment": "Malware payload (Mirai)", "value": "db0b4c834153711572eb826e78d9fc1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090740, "uuid": "175086ea-e07c-4737-bd31-c7fbff651422", "comment": "Malware payload (Mirai)", "value": "4e186da8d9d1501e9006b6a5b76c8b329769f27b599e0789a55544e7555c62cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090740, "uuid": "b42e952f-3a90-4f85-b6a6-f2ca836b36b9", "comment": "Malware payload (Mirai)", "value": "5dd162c1dd012aba724e95d3909f8d35b2304d07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090740, "uuid": "1f9c8143-af3a-4797-b9e0-50461db02c0a", "comment": "Malware payload (Mirai)", "value": "0cb4cd84afd9f2e164e313c3e16b381b953914f79c64085c3633b674b550d1675ecc2b0e2396185d3bea9d5d5bb240cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090740, "uuid": "d0c96802-0609-4cea-ab19-5c067b207eb0", "value": "T19D53BEB3C8196D58D65A41B4B0284E3A6B33F01452D76EF559EFC22650A3EECF50A3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090740, "uuid": "a52482eb-288d-4b7d-92a7-4186309d1b6d", "value": "1536:Q/e/aU1ODyazF8vQEHfQ8nNyozYK+1bJr++/CQk29Z:QW/z119vQEHff9zf+v+IJ9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090740, "uuid": "6793709e-a1cd-4485-a260-9232cfcacdd3", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090740, "uuid": "fa3f64bb-ed3a-4750-a857-8116b1183105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090740, "uuid": "f8d5087d-d7bd-4f9c-859b-ffd7733a51dc", "value": "db0b4c834153711572eb826e78d9fc1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859f94d4-cf51-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652070958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070958, "uuid": "19c582b6-51e8-4e35-ab47-798aa625a2f0", "comment": "Malware payload (AveMariaRAT)", "value": "f46ddd277687043f17e5b662bb5791c0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070958, "uuid": "034aa96e-57ee-4a77-ab15-411f7c156e48", "comment": "Malware payload (AveMariaRAT)", "value": "4f22795323b69ce708b79e5bba5f002d753f58976065e9b3e548bae9a1193b00", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070958, "uuid": "260d7350-49f1-4e91-a7a6-a71dc38414d6", "comment": "Malware payload (AveMariaRAT)", "value": "6fffe01c68aa6fb03aea12f9e715cd2a6ec9cf47", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070958, "uuid": "1e947816-17e2-4551-bd50-486ed192d8c0", "comment": "Malware payload (AveMariaRAT)", "value": "86a5b6a74ac1f918e06e2f81538596fb69325048f99ddc565e3175a90a8d7c07afc9137b2635eeb57ca0de5dd0c6509f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070958, "uuid": "58a8a7be-b9a6-4e38-bb5d-e2bad4626077", "value": "T1BCC25CA3B6BCD103C9926E319AA9DA836F3C97C76C11D53A24DAF15D2DC33E04B1096D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070958, "uuid": "e1ab33d9-b9c8-49ac-ae21-201f2d14a121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070958, "uuid": "b6ef774b-4255-467d-bea1-e410db44f729", "value": "384:BmKaD5TVGgy8NZtq7nPi1jnfkIkOtQLi00GftpBjK/1em6l4aRqbm0D9:BP455y8NZEzAdpuoi8/1egaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652070958, "uuid": "8e0f2a67-5a59-44bf-af7a-14272d2b4fb0", "value": 26808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652070958, "uuid": "90257a72-6dd5-4c08-8992-3d73942fb939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070958, "uuid": "4bdbdbdc-ed30-455f-bf4a-de99e4a13d83", "value": "Offer050920221200_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70a301a-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652107172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107172, "uuid": "a0de9884-7fe2-47e6-9946-600e2d1b866f", "comment": "Malware payload", "value": "1c15fb0aaf36c99a4a47f3d2fbbe8022", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107172, "uuid": "46a79efb-e72a-43a5-8d87-112a254c5b82", "comment": "Malware payload", "value": "4fa03ce7749c6a3c77b9f7a310bd74c23777b66d21b3847b916d6388060b7797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107172, "uuid": "cda4982a-6ac4-47ff-b0c7-6fb5360f20e0", "comment": "Malware payload", "value": "4cf9ef30b77c86112a8bd3a874550dd201a4fd5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107172, "uuid": "e97957eb-1e27-4c79-a811-e065b59f0261", "comment": "Malware payload", "value": "74d89a80047c76000d6255485a3dcd44d25b3dfebd1e04464fc4a436507b2f78a0b65e411765b731a3d7399b01480d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107172, "uuid": "cd63ebae-8416-4b21-b0f4-916b306b2ae8", "value": "T12255AEC6F4A006FFC65220B0419D3B28376C9E60031589D79219BBDB64373D26BFDAAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107172, "uuid": "f6924e01-cefe-4cd0-aea8-09b2a64c219e", "value": "319ef0e1f809594c11253bdf131f5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107172, "uuid": "0c210abb-4e68-48b8-b90b-33be15850446", "value": "24576:msc8k63e6B92odyO5lys6vpTugTlunD8CUH3zS7gyEsH2k4QBb3Isa20yKI:LZO6B92ROL6hKgJiY3kEsWZm3If2dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107172, "uuid": "334b3b6d-841d-404a-8c91-f16aecfb57ae", "value": 1335440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107172, "uuid": "0e8de863-bac4-4a26-ba44-a6eaff1e9326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107172, "uuid": "9df6bbdb-4d9a-4f98-92c0-1d292a54ab6c", "value": "cgB1AG4AOAAuAGUAeABlAA==.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7abfcb-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652110349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110349, "uuid": "a56735ea-e6f3-40b8-8662-c35e923aa95c", "comment": "Malware payload", "value": "f664bd350fe4de5d2d003daeb9b4fdf4", "object_relation": "md5", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110349, "uuid": "c883296b-d276-4406-9c8e-46218e229c93", "comment": "Malware payload", "value": "50e1387078955b69ab956d0f81e935ab6ac9c0260131dd4fa2d3199b681750ee", "object_relation": "sha256", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110349, "uuid": "9636ffb0-c83f-4ceb-b399-f5e2d6a59fa4", "comment": "Malware payload", "value": "39427ea475e305e639ecf14984ffaf42c7442cfe", "object_relation": "sha1", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110349, "uuid": "08278b90-0ac2-46f0-a4a2-a9561ebe1b76", "comment": "Malware payload", "value": "2f282c85a311f688a0c6f4122591f0b0006a0ae2600b913760146aed80a4cb76cca09bce8c4e1fca2d286fd12a8d5baa", "object_relation": "sha3-384", "Tag": [ { "name": "Magniber", "colour": "#9269C5", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110349, "uuid": "771529c3-f595-4406-aa3d-187c11ef42bb", "value": "T151454E2A3A432381F5FE6570D4FB92214919DDF45D17B3292C4D3ACCCCBD8E5682AE68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110349, "uuid": "62af136e-3146-49e9-ae3d-9765116bd8df", "value": "1536:HfJj3ZhpUNmojx+HwSm8757B0Ds0Dw7bx:HIkKxzknx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110349, "uuid": "64ea1eca-6ddc-40f4-805e-b34628b0c3b8", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110349, "uuid": "a2185900-1c59-476f-99f2-82e87878f5ea", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110349, "uuid": "5c09df47-40bd-4a95-a8df-c431071c4493", "value": "MS.System.Critical.Update.Win10.0-KB17753003.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777452da-cfc5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652120756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652120756, "uuid": "45477275-edf2-4b69-9ead-e2b201824b6b", "comment": "Malware payload", "value": "ce995c064a4bc23d5db006d6f3a16a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652120756, "uuid": "f11fe36f-fe05-462b-9af7-0f9d0d0f66c2", "comment": "Malware payload", "value": "516aa64dfe0713af8c6f1953c075d7e84d191a7a9a0f3d3a99a3f80f1f04c01e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652120756, "uuid": "3f82658d-22f8-4775-b13a-de11a12c8a88", "comment": "Malware payload", "value": "2f196ca8a739abe62f13b16686dc19806a61fb06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652120756, "uuid": "73c7126f-0de8-4211-b0ca-fc2ed541a30f", "comment": "Malware payload", "value": "dd9e66a87b5c4ed7e89ec172a8927c376f927002e2714c8164c3275a0f2b6aebbca3a0e82401bc2b4466d540a3b571a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652120756, "uuid": "8ba1acb2-926f-47e8-be6d-9d93a75e95a8", "value": "T1FCC54A20F694DD41E0AE7736DBE651A18BB2B8D52EB1CB4CE34A76D114226132E0F71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652120756, "uuid": "69e15803-c18c-4afc-a356-d13d773a9491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652120756, "uuid": "8b2917e0-b1ae-4ae1-85f3-aa1a8bccd3fa", "value": "49152:KWlrMyVFZEBO6JgGybxwRT+nwGNpGpNHAlhLLSde5JjPxenN+IwjjKCnLg3GTtHa:K5Y5WoxwRilpGDgjLSISymCLg3GZ1X2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652120756, "uuid": "348efda5-619d-494d-8984-7df58227a5e6", "value": 2694744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652120756, "uuid": "68f8b30b-c4e2-4902-a328-102cfdd5c3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652120756, "uuid": "91509e43-1cbf-4f90-bfcc-9ada41db2cc8", "value": "RSX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61322fb2-cf57-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652073474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652073474, "uuid": "d2f83e83-e08d-442b-8560-f0d416c6985c", "comment": "Malware payload (AgentTesla)", "value": "08b33cd90fc8438e59fd04a324758cf5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652073474, "uuid": "f1defe22-2a00-420c-a9e8-b0c818102e3c", "comment": "Malware payload (AgentTesla)", "value": "51bfea8085f5fe90fd7407344b43718c8a12a8550993c00b7b4d3362f7b68a3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652073474, "uuid": "0d391975-bb8b-4d2a-a385-e9ed40d06085", "comment": "Malware payload (AgentTesla)", "value": "a033a9db77d222e05141017657ac5a15ff8b76cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652073474, "uuid": "1a324264-cefb-4d8e-af98-697ddefc9fd7", "comment": "Malware payload (AgentTesla)", "value": "138cd3428a1b9c5b698f1db36e976cd1cd2740d5cdc098fb3d9d901f6f2e78fe894750340c56d93238a7bafcb3009104", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652073474, "uuid": "5c77e0b8-eaa8-4c41-a830-87ab9086ebca", "value": "T183C4599CB12071DEF857C4B2C9682C64A691776B431F42039433F3AA9D6DAF3CE55CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652073474, "uuid": "c4c0534b-2ab0-4821-b5bf-557400051d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652073474, "uuid": "8f8fa272-5bf9-47cb-a809-8e3a5c0fd0b6", "value": "12288:6gjjP89HXk9GJBKzpZKmU6Mwe7zCJhGXjFuppdFVnfk3+I3GR1IY/6m:6gjjMHXVkpZKmb9ePCrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652073474, "uuid": "b689ca54-c8bc-4d04-b524-5192e8967837", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652073474, "uuid": "e6727c35-0fcf-4c05-8c9c-e9564c93bf6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652073474, "uuid": "e4ace979-193c-4a67-9677-1f76b7d0f0bb", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fc40f5-cf39-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652060679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652060679, "uuid": "a23bd4cf-5aec-4685-bd06-61ab2ce68f34", "comment": "Malware payload (Formbook)", "value": "5c106f1abf307d69c1e95bf13598b89a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652060679, "uuid": "63364a4c-1349-43b8-af33-e90d37fbe74c", "comment": "Malware payload (Formbook)", "value": "520f7cca2676f2ce7142e200ea8b52a4e441e59ab44778e513203c1f4429efe4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652060679, "uuid": "3e213dd6-7756-4b5f-9dc1-893cc8b31f29", "comment": "Malware payload (Formbook)", "value": "607863e31928eb35bc6a5766f5be9f11b6a3b39b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652060679, "uuid": "071f52bd-6b42-43d1-aeb8-3ef1ee4faad8", "comment": "Malware payload (Formbook)", "value": "196281e6ba8b7c557c4f4d8b87c0649531d4ec77549f4dc82660443eca0ae41c39a009541ea0c70f95d3604fe82516fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652060679, "uuid": "acce9817-6eb5-4a6f-b711-32276d117633", "value": "T1D29275078AE9E437F4A0FF3056AB929443ECE531382652FB45D7C31866D260646FE9AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652060679, "uuid": "8845f7cd-13a9-4020-8baf-f04f6c3fd564", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652060679, "uuid": "775186a1-8f48-4b94-895b-ee0aa40191dd", "value": "384:U6tUk3vLQY/J25mXd1DbzzzyG9WNLuT81EkEljEYE+C2Y+vn:UkX39AC1XyGcL2l2hBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652060679, "uuid": "a0a3f8dc-d3e3-4d34-8a2a-71d6bb0afe04", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652060679, "uuid": "28dc1b5a-04c1-4236-ac5a-f602cf81574f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652060679, "uuid": "8f117330-5137-41ed-94fd-2778bcaeb719", "value": "5c106f1abf307d69c1e95bf13598b89a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6813c62d-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652107415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107415, "uuid": "ea6aba3d-7064-4d71-83c0-eb142485eed3", "comment": "Malware payload (GuLoader)", "value": "76b1684202e39625d0286497f108583a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107415, "uuid": "d820ecbf-c492-41ba-9d3c-64859e14d314", "comment": "Malware payload (GuLoader)", "value": "5263b83304845c7e9d10109be90bed38e59f1ae8ff8de8c8c5fcbb0634a6c4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107415, "uuid": "b8aa11ee-8b01-4f87-bf05-1d461e8fb2c4", "comment": "Malware payload (GuLoader)", "value": "1b141f602ddbbe947f7deae5d99234a6dd8f9ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107415, "uuid": "046f54e1-ff5b-440c-8b86-4d5dba612911", "comment": "Malware payload (GuLoader)", "value": "fd23046773a126389f6a319a0c0c1237bb3a41cf661e466f08e8d7fd1862db5a9009f4541d695f3b6dcb9666fa2da78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107415, "uuid": "f914a1a1-ebe7-4ead-ab4f-b1b1fabe1639", "value": "T13F2523966360C00BE6315731ECA741F87CB6AF92A87105433702FDAA3DB7B50AB5D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107415, "uuid": "8061e97b-ffa0-4c5f-89e5-5efc7aadc9be", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107415, "uuid": "bc3c8dcd-2fb2-44bf-ac36-d5c09bbf7125", "value": "24576:xYvobEMgDV4zDpK+oM8QWUzsPfSIBanqztelUNkVFaI0:OwbiuhW08fSI8qztSU00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107415, "uuid": "3fa05a78-872e-457e-840a-0ce6fd2bbd2a", "value": 999760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107415, "uuid": "86a0a6fc-8ba2-4eb5-835f-fe2e1dc42915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107415, "uuid": "5ff3aacc-f5c5-4879-a1a3-8028a90c56fa", "value": "5263b83304845c7e9d10109be90bed38e59f1ae8ff8de8c8c5fcbb0634a6c4c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e940cf86-cf51-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652071125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071125, "uuid": "1322d463-42c7-4ec8-83a5-3b4424cda356", "comment": "Malware payload", "value": "6c9017d94ebba76fa009a022cc47c6f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071125, "uuid": "297672af-6b31-4928-9f75-603fcb3c25de", "comment": "Malware payload", "value": "53f330f7212a4e3fb1f942efa722231990af3c986a345d17a3dd451c8762314c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071125, "uuid": "b6858cf7-db21-4f3e-bc61-5cb457facd36", "comment": "Malware payload", "value": "99dcfa1cfd7995057f018d8787411bda73a47940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071125, "uuid": "d774744c-5c5f-4a87-bcd3-818bb42d57d8", "comment": "Malware payload", "value": "1b9c2422d6df41f087f4408f81963cb1457e16d997efef6d4f65726c93785835769d4789337d80db182f1feef5193a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071125, "uuid": "21b66c65-fa9a-4bfa-8720-03c3c3a63086", "value": "T13AA2A793E6480AE0E93607B599771D09066BFF7AF871AB1E489E70356FB31E20063D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071125, "uuid": "9fc33647-d45d-4268-b206-582028f7a690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071125, "uuid": "3fd99283-ee9a-458f-8c4a-a828472cf0d3", "value": "384:BeNsk2qJPAImnP1lHe22bpwBzBF4eR8geJrd3Ig5Bp+ehAikXn04dDf:2v2wwvR2bYBFOTJlfAikXhdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652071125, "uuid": "e2673710-58e2-4dff-9ad5-0a45549375b8", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652071125, "uuid": "bb5ca175-ab91-45ab-a03a-a22b6ae4dd9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071125, "uuid": "4f0f6716-c6ad-4d1c-ba53-63632e4db585", "value": "SecuriteInfo.com.W32.AIDetectNet.01.13850.19219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ec4be5-cfa2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105565, "uuid": "19f3e791-71a5-4a6e-992b-3b44c381f7c0", "comment": "Malware payload", "value": "c712cb72c414df958342250a39dc8f53", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105565, "uuid": "b284f448-bc6f-4b95-84c6-056d367afe85", "comment": "Malware payload", "value": "54dc0886f303707369581df7c3eba4f8f3cc13c3d35ecc2fa7bb2d278d5afd30", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105565, "uuid": "a05567a6-ce61-490d-a8fa-cf09d3fe7fe4", "comment": "Malware payload", "value": "0aa876ae3cea00a68de716a80491fe9bcaa9796a", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105565, "uuid": "ee9df4ab-1902-4988-88fc-349c84c6fda3", "comment": "Malware payload", "value": "3dd55201dc44dab1689cdac61865e4c90854d5051d53f49c5f40f723af9d5eb34d19bbac8b505eeabb2449d358851c18", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105565, "uuid": "fc04afc0-c78f-4c21-a08e-682762be7dd9", "value": "T19913E1ACCF8E4F6CC94B8074591EA9A1CD57AA819A80DF4B0E1CD24E5444CC057AFDAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105565, "uuid": "565ac3eb-a527-422e-b4e3-dff922d6c0c9", "value": "768:2v1Nzv1ssnfkBIJYfTH+niSpFvDHtJgv+nW2FFiKk/f+qt2UMARK+ngkI6J:2vTv1TfkG1BvTtJgv+5FFi3/WqYVAzg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105565, "uuid": "15e6afa4-506d-418b-8aef-dea6038e3205", "value": 43453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105565, "uuid": "4aa50fc4-6925-4a5e-8b6e-efe1b89acfef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105565, "uuid": "0e8e1288-d858-4503-8362-06383df77cef", "value": "Bcxwfhlxvb3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ee0544-cfd9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652129403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129403, "uuid": "ffdafa92-8244-4a57-aebd-67c59da7aac9", "comment": "Malware payload (Mirai)", "value": "0f11fb641edc6a69592a465fe65226e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129403, "uuid": "6b5d60c6-c559-4d6e-b9d7-ac64be855668", "comment": "Malware payload (Mirai)", "value": "56df80a7538e0502cd138b2d4606d12160ed75e1be9ce750edd287eb142fac90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129403, "uuid": "fe0a187c-eb8a-4a9d-83d4-110d7172d027", "comment": "Malware payload (Mirai)", "value": "04981a987901b894f9f900f296e02b973c60b91e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129403, "uuid": "99020d00-4051-44bc-84af-2c57a58435a8", "comment": "Malware payload (Mirai)", "value": "e4e6690ca52f30a726b3e28c8379004d9a2cd8b91b51f764ddf968e22655907053f03420aaaeb06c00296a56445e4e92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129403, "uuid": "0d10f8bb-d665-4971-b5d9-daa65dfc24dc", "value": "T159D2E1F8EF659B8BD0D1A73B4D5DDC0E75AC7D671AB6E6180B410E122039EA0D5E8CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129403, "uuid": "fba181e2-bf4d-4dfb-a03e-c48e056d17bf", "value": "768:xN8fWlfoQmQAXV7EmQciiRcrHKOu3btR9q9:jMNXFl7zNnNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652129403, "uuid": "91d6dbc5-cdf0-4184-bb4e-f06943ff5e11", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652129403, "uuid": "5ac1dd37-c8ad-45d5-9bdf-ad4210496846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129403, "uuid": "5d6b405e-cc32-4b4e-9906-ceed642c8119", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f781a32a-cf31-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652057405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057405, "uuid": "78649e85-2b7f-4079-819d-e07f56dc81b3", "comment": "Malware payload (Mirai)", "value": "62af0349334795d6a50cdbbcad274f07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057405, "uuid": "a5823784-29c1-4acd-a497-e269375406e6", "comment": "Malware payload (Mirai)", "value": "56f2883d96e8b478ccc8851a95327284f6b80dff07344de5f1365d45f7a53a34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057405, "uuid": "4a1345f5-b06f-450c-9aba-c4dbfce5550a", "comment": "Malware payload (Mirai)", "value": "e0ba5211512d1c3f5c1b29bc12d43ec15946153b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057405, "uuid": "a5e2f2dd-875c-4f49-933a-2fda5d497623", "comment": "Malware payload (Mirai)", "value": "c456539ae338afd1696c4eb2e324655dc3e34c651bb0189cfa7580e46808ff767ed5c3940309da86a391952311411ee6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057405, "uuid": "33313416-2ed4-4a44-97e9-f33fa0a1969a", "value": "T1BDC33B46EA818F03C4D61776BAAF42493323E754E3DB730699186FB43F86B5E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057405, "uuid": "d223eede-3306-4d60-a7f7-8ac61ab9af6d", "value": "3072:Fv4D3QbzSuNWh0DkJd9OL/k9j+2jvM/9mTg0OApJO/:14D3QbznrDkJd9k/U+2TM/9UO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652057405, "uuid": "1a1fa818-20af-44f8-b14d-a92e2f1b795b", "value": 121958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652057405, "uuid": "06286c0b-3a66-4ac2-870d-d61cbf8d9987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057405, "uuid": "870764b1-c334-4e8e-926d-7270b2b292f1", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294ba4ea-cfa4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652106451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106451, "uuid": "34fc66f9-e58b-4ba1-9acc-1e9b8204e68d", "comment": "Malware payload (RemcosRAT)", "value": "c1404ca2aaf86cafc22946156bf13add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106451, "uuid": "6f88d4e9-7b22-498a-a214-4e56d4415f00", "comment": "Malware payload (RemcosRAT)", "value": "576183a33f5247a852bc65a4dc4cbca5762bfbad1291a82572681f7075dc6123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106451, "uuid": "0ae8c2e4-f3a0-4e8d-918e-59a82a02bfec", "comment": "Malware payload (RemcosRAT)", "value": "d05f8cda194123515014d2811620924194dd6938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106451, "uuid": "c16f2d24-715e-4503-83c5-ecd1512a97cb", "comment": "Malware payload (RemcosRAT)", "value": "58c8eff145d39fd10bf37a4ca9b697fd5e8edbc7d4b8b3dcff101034e1bc7197d2e0fc16028f489c3dcf786d81886242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106451, "uuid": "afcc3c1f-b533-49a8-96ae-ec0e4b03d412", "value": "T13AB4F03406224095F9765633CA6EDAB47BBB9F73C0012113D6D76E3B3A227B697C5232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106451, "uuid": "105bc9bd-133e-4ad7-8b95-31be8258e0b8", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106451, "uuid": "193a4f64-c4f6-40f1-8421-c2dfb5004257", "value": "12288:ONcmIchLr8RVrwavLi2WTYF0edGi+h5rqhGZvZNuVqh+DsNIj5pG:ONcmIRrD+zTM0edx+2hGZDk2+wspG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106451, "uuid": "ef9b0e10-a986-4003-a5a5-f7bc781825e9", "value": 516754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106451, "uuid": "b13f6a39-ae02-4940-a7f3-d2e57cc139d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106451, "uuid": "a8d02705-d81f-4fa2-9983-fb09816f9af8", "value": "order of 1X40ft HC Reefer of Desire 1kg bag.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5bf6d4-cf4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652070169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070169, "uuid": "5f8dc0cd-528d-4b61-8d63-51c19ebc10dc", "comment": "Malware payload (AgentTesla)", "value": "3c336880634be13e1163003a987d2e1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070169, "uuid": "0af14b67-d935-4e14-bc29-e73a91a20089", "comment": "Malware payload (AgentTesla)", "value": "57798b73d1c044cbf668948774c77628154f6bcacd563b69df088f38b2645fd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070169, "uuid": "8db838b7-8a07-4e82-880a-3938acc4967b", "comment": "Malware payload (AgentTesla)", "value": "9139c833e4fe4f1ebde15e4835ca7fcde0b2e197", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652070169, "uuid": "ad8367dd-2674-4dd8-aa6d-45ff791d3523", "comment": "Malware payload (AgentTesla)", "value": "5312539def857b75b0efcfa10020a5c3279763b6687697b23fe45d2edf454a9ee7710c391ba597fd863cf9e7854c125d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070169, "uuid": "d6a319ff-29d1-4d97-97c4-e62587568079", "value": "T1DB841249B78CA706D17907FEA9B2924417F03DA75D21EB5C2D9954C89EB3B908E00FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070169, "uuid": "65000fa3-5a81-4519-a0bf-b1a7b0bc8011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070169, "uuid": "49a91b86-53f7-42d0-b317-1ce70cf60002", "value": "6144:vPO8A3se9sOReX2voOMFSoOmfLAoPGEMpVr59tOyjIQF9vRMvg8h+oqhyvP:uBlnxmf+EoVt/GK9v98hDnvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652070169, "uuid": "15cf3d52-6b6e-41fe-809a-3fc4a57f538d", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652070169, "uuid": "8b514635-7ef0-488f-b67f-b0603f62109b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652070169, "uuid": "b25afc4c-ab69-4d90-a647-64c43f4059a6", "value": "purchase order_pdf___________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62d88e4-cfd6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652128135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652128135, "uuid": "cff7b50c-71d2-4ab5-b6b8-19d83deb3688", "comment": "Malware payload (AveMariaRAT)", "value": "caf7c989c4c730424211623f30f988ef", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652128135, "uuid": "de540118-4dfb-4365-a56c-c11a777b5b19", "comment": "Malware payload (AveMariaRAT)", "value": "57b301681bf3e53cdec0d4c17cc791b9577a7ea1524a69d247f317b589cb8331", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652128135, "uuid": "71412bf0-1da5-4cd4-ba65-9d44ee27339c", "comment": "Malware payload (AveMariaRAT)", "value": "74c8cd4d9feba96aeba6f915a4db238a57f1fe37", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652128135, "uuid": "4b90339a-2d6d-4866-98ae-8f7666f43ce0", "comment": "Malware payload (AveMariaRAT)", "value": "760bc0bc33114bcef53c4d23d97846642f3a91b0eeca04bf5e0400ca6011010db9039f396de97ee61fff034826d7d3ea", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652128135, "uuid": "c913ed3f-ad79-4262-9dc6-98b2bcd244b2", "value": "T18C35F102FAF1DD71D671183B852477216E3E7D600B24BE8F73887969AE748C0D624BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652128135, "uuid": "9493d914-002b-4798-ac6e-c4f4536964ae", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652128135, "uuid": "0734d6e5-a7d8-4413-b132-aa06fd9363a6", "value": "24576:khvJVJdM0djLA8gHWidMR1iMF1nvCXR4aDwLPOHl:k3dHhgHddMR1ikVv6pDwLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652128135, "uuid": "170d25cc-f4dd-4f0c-a593-8b3153e791c4", "value": 1100420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652128135, "uuid": "49d8cc53-a011-4718-9f4a-6eeab2c83aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652128135, "uuid": "5c2da639-9de9-4cbf-9f7b-0e89a031a72e", "value": "Order Description & Dimensions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a234405-cfe5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652134343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134343, "uuid": "f069a853-22f8-4682-97d4-1a880da18494", "comment": "Malware payload", "value": "5845b8ab5666e96fdcf1e44af088136b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134343, "uuid": "b0636362-3b93-456f-9a30-c8fae9063312", "comment": "Malware payload", "value": "57bab3e5f8ef17b5b71a93a19366311a5478fe358535daf3ca79e54a14275839", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134343, "uuid": "6de6ef12-70b5-48c5-b6d1-52c6b2a74105", "comment": "Malware payload", "value": "0e96980067fde4352d165dc9b2ebc770a7a80b76", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134343, "uuid": "6e561764-7a1a-49fe-969d-24f15da26278", "comment": "Malware payload", "value": "0e3f83697b2c54e45aa5393351fac2f1fdda55b76763dbcdeeb902bc896ed032e62bd8af30fc2bee4fb2665e71123157", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134343, "uuid": "cbb7d9ec-664b-4016-9392-7bd61b1fb9ec", "value": "T1BBA602E2DA9ABC2DD5F3EA72C3790177BD7082E43265E6151511D02C9EF3A0286C8F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134343, "uuid": "0972ee8c-20d5-472b-9956-255f5dd99cc9", "value": "196608:BE8FX6L6B8Y0zP+tfUT1akkUGeTS/mD0sRJePZuwPbn5vru6QHeBZnaZn/x8V:uI6HYeWt8TXkQSOD0i4uwDdrTQHU92nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652134343, "uuid": "8534a111-eb5f-4d59-9124-2f13488fac6b", "value": 10089131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652134343, "uuid": "d552fa30-982a-41d6-b2f2-293eb51fe901", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134343, "uuid": "c12d104d-0ad9-4150-9534-c0e85221d028", "value": "eze.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0a4d14-cfb7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652114913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114913, "uuid": "258e788d-6a65-47ee-804d-0d875ec9fcd4", "comment": "Malware payload", "value": "7f26cb98687ec04e56bc182c457b1265", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114913, "uuid": "4cb0e25f-e702-4faf-9d53-2f4de6d53542", "comment": "Malware payload", "value": "57fe225cc662f4dd01e48d23463eebc6150006715bd51e1f433dd59342634f69", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114913, "uuid": "e5e95022-a57f-44ca-817c-730301aeb625", "comment": "Malware payload", "value": "32fd28d54d0328df820941a63e240bb953b150cd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114913, "uuid": "81636eb8-4095-495d-8fe0-b092853c1565", "comment": "Malware payload", "value": "8248e9488702881cfca7f4a7bebf9d7ac6f29ee715ccd1c6f52c8277fdc007d8fecad6dff005ca8c50b31f16a3d94dc7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114913, "uuid": "a42f568b-08cf-4e6c-8fb4-1d2dc7f405d9", "value": "T135F3F15B7EAAC1F4D4E3803B21A192A3D54D1294D203C09F71EC459A5C76CAE2B4BECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114913, "uuid": "33c9f8bb-a55f-48e8-858a-761735895057", "value": "3072:5gu3EVKMoRX+gSlmm3Ni1RW3Cfwc0Y//9y2rT3GR2bTD7BDRGh+GvWDHN:5gu0VKMWCNibWSf70Y3VrrGk/DPBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652114913, "uuid": "be35b082-3659-4e1e-83ac-b08be58fb899", "value": 168740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652114913, "uuid": "606f768a-f094-4907-89ae-795ebe727fbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114913, "uuid": "6cebd153-530c-4cd2-8832-ac74d7f26222", "value": "Machine Info.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5792b5ac-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652104811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104811, "uuid": "6eea7f49-c70e-4650-9206-b7d58ba2f8ce", "comment": "Malware payload (Mirai)", "value": "913e1e297f3713bf2a514088aca0ba9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104811, "uuid": "86153248-3ceb-43eb-8066-56b17f0ab59f", "comment": "Malware payload (Mirai)", "value": "584184e6300c5b9611e9660ecefe5861240fc6c38f4b1548c967fdbf51a4d38a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104811, "uuid": "c968a8c2-af13-4be9-99be-d565a74a24cb", "comment": "Malware payload (Mirai)", "value": "284fe165b90face6ccb0512842ab533222859e94", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104811, "uuid": "dff2a77b-070a-47bf-afd7-a3bdbc6af7f4", "comment": "Malware payload (Mirai)", "value": "ea3d954f1cb023411977ef29ad97b5e99ecad43816956964d6f5c3c480a34441226eb13676cf8b8781056cfdebbb0eb6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104811, "uuid": "ec2021b7-7c4a-42b5-8007-324c13dbcce9", "value": "T1A4B2D02825777D00D1720B356A22C5CBAA2057BCB1D7BDF221644AFC6ACB2636B3D486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104811, "uuid": "63aa3317-324b-45b3-be27-e1a5e4228416", "value": "384:Z0jz+VLREhwyFJQ57Tg2R0Lxz/CGzXNglHViubmwPiUWhymdGUop5hVt:ZxlEhwy85/pkxzDyV9mwzWs3UozPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104811, "uuid": "1c811377-16d5-4c28-8678-f5afa8cfa3a9", "value": 24656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104811, "uuid": "b6510f0d-4d19-4c92-8e1c-97e4ae729092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104811, "uuid": "cf121cb5-c889-4b1c-8305-7ee8adc03b80", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daadaf10-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652110614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110614, "uuid": "155c647c-a5f0-47f8-8792-beee1542879e", "comment": "Malware payload (Loki)", "value": "ead39a80640836b4bd7537e4b8f486fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110614, "uuid": "85cec9d0-479f-4795-a45a-59c8dd757780", "comment": "Malware payload (Loki)", "value": "58772dd2c00f57ad6e670457de5f2d4e80f3e0acdc70f072192bbbfcec22146f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110614, "uuid": "a82efb2c-91dd-416c-a1b2-277f69498f35", "comment": "Malware payload (Loki)", "value": "9ba5ffb9af0806668cfd16ae57a76268d2ad5c9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110614, "uuid": "f7a69485-2f01-478b-96ce-23de4deac60e", "comment": "Malware payload (Loki)", "value": "da1d3a415bf95f820a53a7e174ea3049576ad38bdfd04a3007d01652f5b5a45197cf4aa0d0ec00c155589c5a83aa04e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110614, "uuid": "aa73adab-f08f-4c5d-b9d0-9ea8f5ca4ce9", "value": "T11794121A22E897A7C17D0FBFE47392002371B8EB9A22D65C0ED634E058E3B545F56B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110614, "uuid": "99229971-61b6-4a27-8a20-d4be609f228f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110614, "uuid": "893816f7-2417-48cc-b575-86c8d5f0e006", "value": "6144:zcONADGZkKtBeClbFZ9SiRcu/PL5o+n+qmeMDUS64t8j/bLdQ:VNXkKtBeCBYi/PG+jGNPt8j/b5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110614, "uuid": "d9b91e61-39ef-4190-a93a-328c5d118bd5", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110614, "uuid": "46d346a9-06c9-4db3-b14f-e87b5daa6a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110614, "uuid": "c3d36d21-c640-4f12-afeb-1ab46d098e6c", "value": "ead39a80640836b4bd7537e4b8f486fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb2ad4f-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105088, "uuid": "d3dbdd12-7d7f-459c-9229-de27a6f48480", "comment": "Malware payload (Formbook)", "value": "fd6ec9bacc4bec3cb792127abcc89959", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105088, "uuid": "578ec237-548c-4734-8e98-2f2fd4a76c51", "comment": "Malware payload (Formbook)", "value": "58a67b3da6d71fb50de8c2351f28c1b8a33d72ed6fd32f76422b10ead2b36bc2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105088, "uuid": "eea1fe32-98c6-4691-a53a-de38725b22d0", "comment": "Malware payload (Formbook)", "value": "f5fe4a3f904ade49ace942e185d3c7eeed4c125f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105088, "uuid": "6411b0db-9df9-483f-acb8-aff2d1715971", "comment": "Malware payload (Formbook)", "value": "59c5b87998c00cf94135403457a0a216284465826d98b043ebc6ac92f99e33015bc2f672c43ac13767e17b559cf6a53e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105088, "uuid": "05b80577-79b6-4393-8cd4-28caf49e6aaa", "value": "T1072412D53E5595DEE52A4A784C1727008268FD31577E2B06862371BF2DF94EA008E3DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105088, "uuid": "cb84d387-7127-44b8-a7b9-283ebce5fd7a", "value": "3072:73lfVSOMdaKbTNzs1hGHW8FR16ftuvG8I/d+8UkoP9+bfZr6LGcZ5S9Jd:BfVSKKbTRs1hkytuuU029+bfZGLBHS9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105088, "uuid": "d09ea975-97ea-49fb-9115-c13ded94b8a3", "value": 211560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105088, "uuid": "a0b34b14-60d4-43cc-86ce-5897e5dd3af7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105088, "uuid": "90675cdf-c8d8-4d9d-8af9-a102e6a366f1", "value": "Revised Order BUCKLE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e560eb76-cfbb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652116645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116645, "uuid": "d63b1637-82aa-442d-973d-5b5d613fa7f1", "comment": "Malware payload", "value": "b61dfe61a785668476d9f223268f2cf4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116645, "uuid": "6ad216a1-7b1c-4301-b2f2-ac581e43713b", "comment": "Malware payload", "value": "5974a6fcf0503f34709dbcc572d30d76ab64f655444ae83f088ec975ab26cb7d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116645, "uuid": "b33d0d87-760c-42bb-8200-648cd9d9153c", "comment": "Malware payload", "value": "c4c2bb66b62486937384c8e63d2922e022e0c335", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116645, "uuid": "db5677cf-8498-45ee-a600-5dbe269f8f0e", "comment": "Malware payload", "value": "2e2b4505ba0bb195b6a2a6b9047a55e2a3fa27f5f48e5f1cb17ede8278ccfc088918d32eca47625899de5e6051095cee", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116645, "uuid": "328422bb-3765-4653-811c-1f93b37941de", "value": "T191A112BAF684C5B0C61FE6398248BC1C0520BAC3C2D02DC467BC6C2A9C95FCF6D656C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116645, "uuid": "44288d07-9d26-4241-927d-4b732e3cbe45", "value": "48:CBn6zALDCn/r4vGXKQuT4vGX1ebB7xxg8PzUPeSy3n5ZWibrE7xxpsGyN5nVJA7C:CB6zVnUujruYlxbnExLAexFC1nPnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652116645, "uuid": "e15d02ba-b54a-4218-88ad-019073c24619", "value": 5001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652116645, "uuid": "d9b907e0-ab09-4152-825d-92c38df1adc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116645, "uuid": "21a25b3f-460e-46f1-b647-59cb9f9ad761", "value": "attack.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4913cc62-cf8a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652095338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095338, "uuid": "99f4bfd6-efa6-45de-843b-54003cd90212", "comment": "Malware payload (AveMariaRAT)", "value": "07683fde25ef9ad29809f71e20486d27", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095338, "uuid": "dd23adee-d356-491a-be2e-c8efea2c0d69", "comment": "Malware payload (AveMariaRAT)", "value": "599d3dc564e66f5006819db3b30a3db95b9b3dcea96c8c95969d21193f60798b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095338, "uuid": "44f331ce-02f4-47ac-8e1e-3fefad8f39fc", "comment": "Malware payload (AveMariaRAT)", "value": "a98e7ad168d04763c12692725f5ad445e52e511d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095338, "uuid": "81a51f82-97d6-4c20-89e6-a3990c93aeee", "comment": "Malware payload (AveMariaRAT)", "value": "b2933b10b4874e756ff7f6355b103aecd6e4444314e2e2ba07426cff5ac291a0a5efebebee8f81b336d77ade9c559c29", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095338, "uuid": "f50391f3-03b4-41b8-ba4a-b3e4856e50b7", "value": "T1FFB48FC265045BE2DDFC0D73F86708B22A609CBF83D154A629EDA76B04E19318B1ED77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095338, "uuid": "a61d7ea1-7cc7-4697-8f65-cd2b9ddbe701", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095338, "uuid": "e6a60ca7-6f55-4d91-a28c-5a033c991f35", "value": "6144:ONeZftOosSBJnT6rAIZNIoxjK32QuafWiMMciB4DFb4n:ONEOoDnT6kIZN55Km3af+McR5bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095338, "uuid": "00f8268d-4f05-44fc-b5a8-000e2419a9a3", "value": 531962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095338, "uuid": "1fab5da1-af46-4040-8fb0-7b702aa32f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095338, "uuid": "a67f3b8c-ffb8-48ce-b384-3a7ba62c65eb", "value": "Payment copy of April.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98804a74-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652107067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107067, "uuid": "2d1d88cd-0382-4b19-9b2d-d41e9e3d9b6b", "comment": "Malware payload (Formbook)", "value": "c6c73225b736ebe2e2dd293622f641e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107067, "uuid": "f8e4abd4-ab49-46fe-94a2-42bdad543e88", "comment": "Malware payload (Formbook)", "value": "59a7fc4a8a50af26da5eb5cd0142fab8ef93140c2dbade41fd4ce316778ec82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107067, "uuid": "98a0a0da-1d8a-4a73-af18-b46346bde353", "comment": "Malware payload (Formbook)", "value": "3a56163a6b7a1422cc9d9c641c959968d7935c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107067, "uuid": "0f2a664c-2478-4b0b-b798-60d9e659117a", "comment": "Malware payload (Formbook)", "value": "affb5aafa159c888be0850a90b89c964952b516b10110ff6cc9e345bc614ca99b20a44d74d73b1e6e6f44eab52c5e66d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107067, "uuid": "885f436c-1358-4b7c-9cba-30c1edab2eee", "value": "T14ED4021122AA8B36F7B937F2639513C013F73E4AB132F6D5BCE022EE64A1B490545B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107067, "uuid": "4abe9eee-fee5-4230-b497-294d6c156760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107067, "uuid": "6b20dd10-fe32-41eb-ac91-7e6428d7d40c", "value": "12288:4B2L2Ih02L2IEWfAM+i/24mMVC0Cu9W4e00t0i2sSeVqA47:82E2Hff+pnKOuY4e00tKsSeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107067, "uuid": "2b9452b3-be36-4926-a119-a3af4c60d13d", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107067, "uuid": "0b50965d-db17-4ed9-b7c9-122f080f2845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107067, "uuid": "398b118d-59ab-4055-85fd-90876bbc1fe8", "value": "c6c73225b736ebe2e2dd293622f641e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a164857-cfb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652114344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114344, "uuid": "e5dfbfa7-1ffc-4721-8fc5-8012864bce20", "comment": "Malware payload", "value": "78ac349d1dd799a13294226b4bfb2f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114344, "uuid": "3afbead8-886a-48f3-8cc2-294e06d94690", "comment": "Malware payload", "value": "59e1f561914294d4705be15059a0a4aa093b80480c3842fb005a3b3b6355f435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114344, "uuid": "7ad470f2-bc13-4a37-8ce6-96487f5dbd9f", "comment": "Malware payload", "value": "f7f13579d1b24ee8c92ea5af54e9ac732f1dff1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114344, "uuid": "c5354f90-d9ea-4a96-9bb4-485dd1377bfa", "comment": "Malware payload", "value": "f6e87c6c1a2c5d9f0c5ec912a8031fcf340c2f01f745b55c9a74f01f54e8a4bb0c4b9877e8bd114ef850671c00d7bb3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114344, "uuid": "e478b559-a11d-4ffd-a4ee-0ea71c2c6606", "value": "T1ED35D01DFCA3D553CA385BB34526D23803B22E446A11E1262E8977CF953EF73C9A5683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114344, "uuid": "9c6367ea-afa9-4e1d-bc45-517c73000f7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114344, "uuid": "8eff56f0-e4c3-4a0d-8cd9-89c006dec1d3", "value": "12288:ISZHBHx2CLA7jyfZ6i4VdYMhODAia8je7vywf8mHQL8JZHBnZHBvZHBjZHBC:ISdX5eSHda+iPf8DL8Jd5dxd1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652114344, "uuid": "e36b2d5d-dce6-453e-a6e2-a132be76a488", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652114344, "uuid": "f132d164-2472-43d9-9ea2-bcf8cc95926e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114344, "uuid": "1a53560f-3a6a-4160-a1ca-76efa77f2d78", "value": "SecuriteInfo.com.Trojan.DownLoader44.58468.21897.5260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8391bd-cf7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652089010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089010, "uuid": "8f13be27-2389-4075-9ffc-c15bddad7bea", "comment": "Malware payload (AveMariaRAT)", "value": "f6cb0c197222bdf070b52b864d9704cf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089010, "uuid": "b5a4156d-2c09-45be-8644-50101be621de", "comment": "Malware payload (AveMariaRAT)", "value": "5a64e6d115b4b45fb833fadd23c4a50defe04aff210200439c6470b75f615902", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089010, "uuid": "401d615d-4bb9-43bf-931f-04e6f77cbb25", "comment": "Malware payload (AveMariaRAT)", "value": "ea483db82fa7f4a3affbed95fd7b732f21e24f0b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089010, "uuid": "5eefc752-1513-4ca5-9439-13431e542c2c", "comment": "Malware payload (AveMariaRAT)", "value": "f23e6986c1d7b2fe21aa74cc6486b177c1a825992c3e3117d30274d2d630449605e254bc5b6d6e6b0f29ce9371589e58", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089010, "uuid": "55d427d5-e4b7-488e-8d3e-70e57cde4f4f", "value": "T104A4AE9D712076DFC853C4729EA8DCB4AA506DBB931B410794D72DAFBA2C887CF540E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089010, "uuid": "210db41b-dd69-4660-9357-4ac33ab2e53f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089010, "uuid": "6e4b0093-07e5-4860-a365-2b4f074efdd9", "value": "12288:FXXd7ze/9PAh1ZomlXazCi3PiWwUNtzljHZIUWZr:FXXd7zs9POZjlqz5iWwsz5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089010, "uuid": "ea95084d-63b2-405c-b9f1-88d029168f9c", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089010, "uuid": "6434bda5-c57e-4080-a05b-249742c585b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089010, "uuid": "d0122c74-36c4-446e-af41-28e91e78854f", "value": "SecuriteInfo.com.Variant.MSILHeracles.37619.22771.18041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5149dc-cf47-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652066805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066805, "uuid": "3396474c-4a43-4793-a036-8a859dc28c92", "comment": "Malware payload (AgentTesla)", "value": "6a573ef0184001c6ac64c34241c373f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066805, "uuid": "74dba80f-399d-4b1d-b4e8-cf42355cea31", "comment": "Malware payload (AgentTesla)", "value": "5a69092c2d9decda22f216947a5356ca728bc72538ab8a812236d86e64b2fbeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066805, "uuid": "d3817478-562e-4c5a-a4b0-f5ca431753f8", "comment": "Malware payload (AgentTesla)", "value": "9542d07689c23d2e32771b9a973a13cfecb83dad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066805, "uuid": "42dd6411-92c6-4c3a-b047-b65336608dfc", "comment": "Malware payload (AgentTesla)", "value": "3b141f1c385e2905d07f8e244272ab060d2d645b4d98af7221e03a11af3ea35501ac5e0c01f75da8b43600004f8a18fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066805, "uuid": "5ecbc1ef-1d05-47ef-95d7-d1266087ff28", "value": "T13AB45AACB12075DEF85BD071C9682C64A691776A431F42039833E3AD9E6D6F3CE54CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066805, "uuid": "3d316def-ba21-4116-98b4-3f81702c7faa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066805, "uuid": "6c928abb-e4a9-4699-94f1-48e87dc7506b", "value": "12288:UgjjIjykogXLsx6zN/gVlAJBJwfbupmi9i24ECLMMpG+yl6m:UgjjwykoQLsczNYVlAJMfb8mAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652066805, "uuid": "b57aed18-eb7c-48c1-8799-fc30950c17e2", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652066805, "uuid": "42762e0d-0535-4bb5-9f8a-ce7ff2f8b112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066805, "uuid": "cb69d5c1-bb8e-4c63-add9-1f6d4596ad54", "value": "Payment Advice Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfd63b9-cfdc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652130695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130695, "uuid": "f114eb67-553b-4662-8063-b2a20ffada1e", "comment": "Malware payload", "value": "77cca26e33820b2af4c3fabf55a59da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130695, "uuid": "7ae2b3e0-44f3-4dd3-ac11-ec004c3b68f6", "comment": "Malware payload", "value": "5aba7ad9de8e24460cd36042fab70a5e3f0b3d8661b331a1cc67ce9c45874270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130695, "uuid": "ad9fe5c3-7e9c-49b9-bb03-ec33641aa7a6", "comment": "Malware payload", "value": "12db96b1f931c7844dfb9e35b85ccc1dd4b5d1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130695, "uuid": "7a8ad86a-0c73-4d52-af4c-adadb4a5b853", "comment": "Malware payload", "value": "107c42f3a6d8c1a399773303fda6207efee356d233befc866f90037a044d6fcc7f3b4186618a378bab0d857421619347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130695, "uuid": "3ac81e6f-e913-4897-8e5d-dfa0d38982ac", "value": "T15602B5047BFC8605F5BF8E7428F26B224279F653AA13C22F1885415D1D36B41CFA2BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130695, "uuid": "e5ff016a-982a-4353-8b1b-0790e2daebd1", "value": "192:mIEWUBFeC9+9sZN7w492+A38ZwZjdewRF7sdYo95KrWTaYC:yjj+9y92+AsZwZjPT7AyrWTaYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130695, "uuid": "cd361c3e-ef22-4ffc-8d40-4e16ce0d14a3", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130695, "uuid": "48ec08fa-6f10-4e32-9c6b-30309e98fc35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130695, "uuid": "2e034a5f-bba5-47ca-9e7f-10129c2968f4", "value": "0x0009000000012300-89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d01882-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652105189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105189, "uuid": "197ff6ee-d66b-4fb4-8d76-57c04e901e3e", "comment": "Malware payload (AZORult)", "value": "e3bfd2948bd584334672ac65108cee43", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105189, "uuid": "60ea727c-27ed-4c47-99a9-bd4075a0140c", "comment": "Malware payload (AZORult)", "value": "5ad663575ba3eb36a727962c8340ac2a3157bca747aff225a9e0061fc7b34978", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105189, "uuid": "ecec0a8f-b3c2-475e-9010-5664d3aca2bb", "comment": "Malware payload (AZORult)", "value": "03d78f4e13a5721b841830225e94bb22efe110a0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105189, "uuid": "c19aae15-48cf-4171-b50d-7fa5fa071073", "comment": "Malware payload (AZORult)", "value": "b3990df131f1bc6ce2c357a4f8a0e49821f8be39c689332d232873a262cc192bada4951ef652901b0af9412c1ba0d23f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105189, "uuid": "9e4b1b33-aebf-4643-bac9-7b965d5bb08f", "value": "T165A4389CB12075DEF85BD4B2C9682C64A691766A430F42039433F3A99E6D5F3CF45CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105189, "uuid": "7a25e384-ffea-4de7-a2dc-ee9989949f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105189, "uuid": "14955bc3-965b-406c-8b16-a70b05fff66d", "value": "12288:7gjjzCuMBx6uWOenzWaPocGmNrd1MAfF0UhlccwzRv7wqkHcTo6m:7gjjzCzeHOIzxPoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105189, "uuid": "5ed77621-9c98-4bc1-80c4-aebf60183aff", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105189, "uuid": "ffd3fcef-32c3-4ed3-a99b-c453d0f4b04e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105189, "uuid": "1c8a1d60-c215-467a-ad70-c11e3ec90601", "value": "E-profile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af08837-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104253, "uuid": "42a87307-338f-4cab-994a-340065a3c9c2", "comment": "Malware payload (SnakeKeylogger)", "value": "77207757cf8e8307c6f3afa39017a88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104253, "uuid": "b68c0d53-9b05-4697-bd59-81edbff901c3", "comment": "Malware payload (SnakeKeylogger)", "value": "5aee5dffaf887453eec391906510d31da9d2b13a661af2b2eab943ecf6d53397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104253, "uuid": "1a78159c-6c6d-4d51-82b5-2da695248d76", "comment": "Malware payload (SnakeKeylogger)", "value": "2eed2bb3e68af882af2c5cce1fa4691df720892d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104253, "uuid": "2b320998-e011-46cb-a2d8-996bb346ca16", "comment": "Malware payload (SnakeKeylogger)", "value": "452dd530a1fb460ff64ac8cd6340030f08a0388812644743b20ff196660734ebb2e42c7e37aec5951b90317a9f24667a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104253, "uuid": "b102236d-b560-46f2-aa4e-c78cdcd559ea", "value": "T1D4A4011EF6EBC682C47D563BD0D164240371EA83A823C63B2DD6019A5A53BCB4F42BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104253, "uuid": "ff252999-0f7a-4b57-8c3a-0b4c6c393b86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104253, "uuid": "9b48053a-6635-4ebd-a460-c1509835d84b", "value": "12288:QrvzuJmhyb1T8AuAhU84TVSrrmTKt2hR1bH:M+WMIAuAngVSvmTKt2r1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104253, "uuid": "c692842e-da72-45e0-b215-e6d40391a024", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104253, "uuid": "ffad9cbf-02f1-4f26-a5b7-24f8ff9b085c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104253, "uuid": "65149c57-f065-4a91-bea7-78000efa57ff", "value": "K425-11101.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed73c3e8-cfdc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130832, "uuid": "36d06a35-53f9-4411-a4fa-a1105de33423", "comment": "Malware payload (Mirai)", "value": "1b4c57c255f988e3cd79c2d6bb94a45a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130832, "uuid": "a81b461d-6ec0-46a5-8855-f41a7735e2d4", "comment": "Malware payload (Mirai)", "value": "5b0cc89a58ecdf962f08775d0202a4287ca1fc34c5ef7f404239bf0d6969061e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130832, "uuid": "36ed1495-537a-461d-8262-eeb7753ed50d", "comment": "Malware payload (Mirai)", "value": "11b9588c0d2ab797d493e09373cbc4b39dfeb20f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130832, "uuid": "b712978b-891f-430d-909e-72c2bc32c794", "comment": "Malware payload (Mirai)", "value": "81986e27d0c2c53c759df4168c4b220faf4c0914131a2047488cb06cd8e3ac10f00448d7f6507a58a5a934594ca600d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130832, "uuid": "09888e59-d043-4250-a145-1ac9bb2b7ce9", "value": "T154D2D0BD4B0007AAE9AE40B92AE907E93DB54F10E0C3AE5E5985BBD1CE808F535975C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130832, "uuid": "5f0f727a-deb4-407f-8e82-5079c5a11017", "value": "768:tyvYLznDEB2iC+sDqC6NtxsLLd9AtQjpquX4JgGlzDpbuR1Ji:oYnnDEBI+smAd9AtQt8VJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130832, "uuid": "b8685c37-0ca3-419d-83fc-9744bc2ce0c8", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130832, "uuid": "be994b37-06e6-4e72-8aa5-b79c0b56a4d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130832, "uuid": "ff388cab-734c-47c0-9973-c276080d9306", "value": "1b4c57c255f988e3cd79c2d6bb94a45a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451f89d4-cfc6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652121101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121101, "uuid": "616c523c-036b-44cf-9e68-ef24badb507d", "comment": "Malware payload (Mirai)", "value": "bf3bf1bb773ac147b5b7d30ddcb58b24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121101, "uuid": "cab0e2ba-a441-4b64-a4e5-4ad493ad3e18", "comment": "Malware payload (Mirai)", "value": "5b74ca0aad7ba32e78d637931950ebe0c2841b8107bbcdaae2a0753ec0097912", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121101, "uuid": "5f7d56f5-9b85-4bb4-9114-23fa437be03b", "comment": "Malware payload (Mirai)", "value": "6819bf5ae5602181ddd9dabf043c07a63f70308b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652121101, "uuid": "daf844c6-4949-4c30-9754-cb31e0f2066f", "comment": "Malware payload (Mirai)", "value": "3e663b0f673aebede01e7d7196cd1128557837199233db723693d5ff252478cc1e85c8a0785f465dfd44fa1a941d2fce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652121101, "uuid": "a7e7a805-7b98-462d-b968-9913f92f90a0", "value": "T1FA630985F8C745F5C8074A3460BBB33FDA32D6BA40705A6DEF59AE32DA37701521238A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652121101, "uuid": "072a0023-2d78-4b49-b4bd-449f3486dbfe", "value": "1536:HzrP7QIlOudSxvw0qXWw6gfY3JpajqOF:HzrHlOuslqX4gfcJojH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652121101, "uuid": "beb20347-cfcd-447b-aefb-2dcde3765a10", "value": 71312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652121101, "uuid": "72a70c10-225e-430d-b24c-f30a29ebe334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652121101, "uuid": "626f2ec0-c35f-4347-962d-964759aa9fea", "value": "bf3bf1bb773ac147b5b7d30ddcb58b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246ad235-cf9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652103866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103866, "uuid": "3a8f2907-d9cc-430f-ae63-804f85994b70", "comment": "Malware payload (Loki)", "value": "c659bf9eacb99dc3b2f49518ae9bbcb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103866, "uuid": "989d02d8-1e6b-4fe1-ba0d-438cbcfa36e0", "comment": "Malware payload (Loki)", "value": "5c58b923afaff926a59bd2043c8f176e905e6989ff4fb7f0654f49a0b474f618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103866, "uuid": "be9d6a38-cd0e-40fa-bea1-43e308fe7587", "comment": "Malware payload (Loki)", "value": "ffc5633515904358ecbc1e6ea51a10791c19b445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103866, "uuid": "9ca6d5b0-d9fb-4d62-a849-44080422464c", "comment": "Malware payload (Loki)", "value": "83cb56bb2ceb3026ef66ba61fd28e5e610733fad29e9864e1523140b29ebae9cabbcfa17cab50c8a3ea095c5d7fc2475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103866, "uuid": "ead03672-d217-411e-9b86-e262aad31079", "value": "T19BF301943BA0D4F7C9E31B712D3647A35FBAE83111A8470F9301AF9E7B646818A2D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103866, "uuid": "025686de-a2f2-40c1-b8d9-5683fcf8bb9d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103866, "uuid": "d7d33ec7-f22e-4dd0-85a6-e769623b321f", "value": "3072:l1NjcVVnLpPunbCVpZQuJjV/agWhbUGtfrKEts6T/aNdLdSRusFdFV:HNeZmcWKBzWh5n2NpdS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652103866, "uuid": "9e368578-2da7-4348-90fb-7e3d055698cc", "value": 162216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652103866, "uuid": "1478dc17-0598-48d1-897b-2b3237b3fa30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103866, "uuid": "5d516e55-cccc-4a64-98bd-00b268274fde", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0e73eb-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652058644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058644, "uuid": "3e8e309c-f2ea-4187-acc6-977b5881d095", "comment": "Malware payload (RedLineStealer)", "value": "ff791e2212ce12a8e334ce553857eb89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058644, "uuid": "93d73a3f-10c2-4b14-8899-28ee9a088fc1", "comment": "Malware payload (RedLineStealer)", "value": "5d4cd0ca70d224e17ba7f0c1a0a64cd68505d8ac10ffc23d96fba3ae166c60c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058644, "uuid": "17b35b19-2cab-4df8-9cd0-e8cee9b79bc1", "comment": "Malware payload (RedLineStealer)", "value": "1d76dc8f24fe839b8938a6c84fa55dfabaa10e39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058644, "uuid": "32045ae1-26c2-4f05-b8bf-735715d670bb", "comment": "Malware payload (RedLineStealer)", "value": "0a6c13f6b2c2abab2c11fb2045071a8d893d869082bab97488ca77fd943e550c9a2e75e0adffd620d74a3dd11fd67d34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058644, "uuid": "83b1c32c-2982-4f84-ad3c-dc69d9362c4e", "value": "T13E85BFE3C741220AF252F479C02E9D6D78B20B3157CFB87367899AE9931B2D0462DB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058644, "uuid": "1dacc652-ffd4-4d0b-8960-e6c25aa1fe20", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058644, "uuid": "ce5c7183-e20d-4396-af81-905e12324ec1", "value": "49152:OvtA9e9QH4cqT63e9C1HQQ8O3lEUL2GX1bF7R7BgKxCH:Ovq9e9QHNqT63e9I+kl/LxbRBzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058644, "uuid": "e4134e95-5f39-4822-92fb-1dfb900c08ea", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058644, "uuid": "450edb94-9e8c-4fb6-866c-24cecdbb6e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058644, "uuid": "ecd43e01-dc0f-4151-af1b-c632a1dd8d97", "value": "ff791e2212ce12a8e334ce553857eb89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d233dbe-cfcc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652123718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123718, "uuid": "12bb4fdc-cc18-4c97-9963-c0ba2c141d56", "comment": "Malware payload", "value": "f67d3db396527cd894d58ef3419e0b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123718, "uuid": "b38768c5-a608-4eca-a566-707198d893e9", "comment": "Malware payload", "value": "5e9a787106ecb45057e71e326da35d5934606a37720fb47d260ad83f0dd86f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123718, "uuid": "39990746-8792-4da1-8eeb-28188165c3ad", "comment": "Malware payload", "value": "4310e53ce4034171433a87d50af03bbb2c1816ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123718, "uuid": "4bd55566-82ac-470d-a272-dc27daa0b844", "comment": "Malware payload", "value": "4d5eba4cd588205b4aad927e2601cea8eca7608060cd81945a87851162143e280bb732dcfbde1d581052a3b62e717bc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123718, "uuid": "4186eba2-8d5b-4ff4-bc6d-ceb5f6c2ae87", "value": "T190F4AF22F3D04437C53229389C0BB6FA5D36BE182E35A9862AE53D4D5F396D1363A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123718, "uuid": "8e806d92-ade6-40b1-acbe-c44bfcc61a38", "value": "8aaab755596d4e153deff3d89570bbae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123718, "uuid": "032c6aca-06c1-4380-a3f4-71015cc072ac", "value": "12288:8l9yyrn6OMyZINEg+Cu9aZvofn7EqNNY0ENwMeBAFCvU9r4FKI4/8:ClLRZId+d9aZvcVLOGHswJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652123718, "uuid": "31def0f1-fc16-4509-9feb-afa654ff3474", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652123718, "uuid": "96a56571-7988-4eea-a6c2-0a346590c38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123718, "uuid": "377c8f3d-f44d-44c2-a340-49a14af1cf5e", "value": "INV001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70c5d04-cfdc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130848, "uuid": "91ba5a06-0ab4-4844-a49f-b42bd0f5f9df", "comment": "Malware payload (Mirai)", "value": "e22472bed68182de84a44953841f0237", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130848, "uuid": "e34ed9e4-0975-4f67-807b-df33ed99d694", "comment": "Malware payload (Mirai)", "value": "5f7c6d091482605a1c5c06180a90858c35d44bb7d0c791334cd3944ef3315c89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130848, "uuid": "96f35618-955e-4663-9f93-8d752f12f279", "comment": "Malware payload (Mirai)", "value": "50ba2b5132c98d36b2686cf4d96b08287ff93b2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130848, "uuid": "7a299967-72f3-4bbe-b7bc-db70fa7f6728", "comment": "Malware payload (Mirai)", "value": "b06993b9b3b7bacd2d291de7aaa45df3af1beb87d74b3219fc7d2bac56f42f8143783c0cd00186bc906b0ae52f21f719", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130848, "uuid": "691925ba-0d20-4bc5-83fa-73b564916352", "value": "T164F2E0636856DDA1CFF0313AD6E07201BFA95E7DC16474B216602F54BBCF98F64A018B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130848, "uuid": "7315f3ff-ed0c-4e63-b48c-20591a803e7e", "value": "768:Cb+GsIbn0XpiTAPB4bT9bOs26GIa+UqaXG59q3UELQ1:Cb+GsLidbT4s26dVUqaWsL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130848, "uuid": "8ca6e94d-8444-41dc-84a0-63eb88481538", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130848, "uuid": "275b41d3-4ac9-4b30-b5f9-7da383851a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130848, "uuid": "4691aae8-8fba-4078-beaf-9b817b0ad13f", "value": "e22472bed68182de84a44953841f0237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bd9d0d-cf5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652076305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076305, "uuid": "fe34c0a7-896b-4a22-8dea-13bf3ff13872", "comment": "Malware payload (AgentTesla)", "value": "9d55166d58f17f024eec42916e7e0652", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076305, "uuid": "b95f91e3-182a-4d9b-b8b0-71302d70c175", "comment": "Malware payload (AgentTesla)", "value": "6107be0b7e26a0a4f6a2f2211cec5a09f03ec33c63013aae510318ff6ca63ff6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076305, "uuid": "ee5705f7-3f09-41dc-9acb-d63f5be1ad3b", "comment": "Malware payload (AgentTesla)", "value": "6e43b970445e351056c689fdef4ff6848829b355", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076305, "uuid": "c58c7e0c-7a20-4ed7-a4bd-6752d63e4e78", "comment": "Malware payload (AgentTesla)", "value": "ab3f20d4c219b695d9e24183dd60fc99524622091557020e0fe7a44befe71110d9da30f75b1b8d3fa8a053c55f399e2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076305, "uuid": "c2f54e35-631d-4432-8434-48ac8a56aba2", "value": "T1EEF4238AF957624FE9A2B7D20B8B322C48B55B251B506AD172DBCC7C85450D2F823F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076305, "uuid": "7cbb8146-1626-48d2-b075-58db82450f98", "value": "12288:zCrFhsN67GBrEn/VYl1UeQmlQHGeRyg56hd/GS3KF3Ro0wLH+c9hkUMynnF0J4:GxhzGpiWl1U/zH1ahdOS3Q20GbnF0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076305, "uuid": "2cdab91f-dfcf-4455-b40e-afd9cb2a1c65", "value": 778205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076305, "uuid": "b5569fef-50bd-4d09-9494-18499823ab81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076305, "uuid": "ce9b4b59-44cb-43a9-8391-0bf9a2ea5bca", "value": "SOA PDA SETTLEMENT PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75eb8ee-cf8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652095952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095952, "uuid": "e4dd2f9d-856f-4756-bfa0-7a5949f985e5", "comment": "Malware payload (Mirai)", "value": "ed9dd0ffbddaeb850e96b93066ca9fc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095952, "uuid": "6cb936d7-4c91-4586-9112-d92343b72219", "comment": "Malware payload (Mirai)", "value": "621bdbf260f23c7b4cd34ef54777d9447564e088bb6b1495c570678b198b8146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095952, "uuid": "7d3de4d1-9226-4c19-b38e-d10183ac7594", "comment": "Malware payload (Mirai)", "value": "f30444972b5dc4afae23a79517681797b4dae877", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095952, "uuid": "216b8555-d942-4753-b0c9-deaac6e61001", "comment": "Malware payload (Mirai)", "value": "3e1a710eb535a92089e0cc63cda8d0e4f97aa039d7e80ccf4e3bf47743dbffc17250253a0d0a693f727d0d9e6bc708c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095952, "uuid": "f2dad8b7-2c85-4975-a1ca-f4d694b4bd9b", "value": "T1DC73AD33D1686DA8D0664B75B9988E309B23A28416933EF6D794CB784013EECF509FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095952, "uuid": "0b5b250e-93bd-4cc4-964f-0da4a20fe9a0", "value": "1536:9aD/MEGvbwt+i7EhHR1n8C/0rrnmFQlrKkNGIkFgCJl2c:9OkdzeEhxt0rjhlOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095952, "uuid": "033f91ca-9414-4f4e-8a1c-c24e82ace22a", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095952, "uuid": "e66ebe65-56bc-4a39-8cdd-d053ff89121d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095952, "uuid": "23af20e5-d12c-46fa-b061-af3432e83a55", "value": "ed9dd0ffbddaeb850e96b93066ca9fc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2073ee24-cf75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652086250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086250, "uuid": "34882b93-c5f6-48a0-bd79-ba7defdf95ce", "comment": "Malware payload (Formbook)", "value": "1cce7a560ac0dea6980cd0b961eb97ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086250, "uuid": "cb26ff9d-601c-4ccb-9561-279af9d25b07", "comment": "Malware payload (Formbook)", "value": "62db306fa20a6e4ee6de466495fcbee3a4300ac4c08fa28059258065e969b3d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086250, "uuid": "fef58a20-5693-4c1e-8327-2bc194178e9d", "comment": "Malware payload (Formbook)", "value": "5e4e992786b6722cead66b4385755f0a6523babb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086250, "uuid": "07fe9509-a2ed-4be3-9986-10f2fad3eb36", "comment": "Malware payload (Formbook)", "value": "5dcd9e4fdf1a7098620f630da1d84fd8328a9324c845fb3c52e3b67e9b1840c2aab94824287d57f22772050f07c25513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086250, "uuid": "8c35be40-260e-470b-b404-c7407b5c6b06", "value": "T1F054CE019150AE22F9F34E3119A75E0296A79FE1206C528B56337F1EBC61F4E793B21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086250, "uuid": "25f6a1b1-c079-4370-b2f6-992e8cec852c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086250, "uuid": "d89f6e91-0555-4141-a08c-cfc72ee369bb", "value": "6144:RNeZW03EaBlasxoGk4UxdCQwz3/KON5xKyylYL:RNJ5ok407wzPNxMlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652086250, "uuid": "3bdab0cc-fa2e-4126-88f6-f7c79cb97418", "value": 296659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652086250, "uuid": "4dc6c36a-a3cd-4e0d-b976-5f1fd629ee9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086250, "uuid": "39a57770-eca3-4aeb-ae60-1769f23311d5", "value": "INQ No.1239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a6ef11-cfea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652136694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652136694, "uuid": "d9ac8da2-6419-4d42-aea6-3f4363eb8ffd", "comment": "Malware payload", "value": "66e079c3a6f33f3838b287d2e8c527f1", "object_relation": "md5", "Tag": [ { "name": "obama176", "colour": "#63A968", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652136694, "uuid": "9255fe9f-5ccf-4879-b78c-f81beef6fed7", "comment": "Malware payload", "value": "63790f11728510ba60e1c151c3502f53c9628ced58e58ecafe6ce38d6acb5627", "object_relation": "sha256", "Tag": [ { "name": "obama176", "colour": "#63A968", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652136694, "uuid": "8b2e666a-c9a2-48fe-b564-8ee5ee91d6c2", "comment": "Malware payload", "value": "f8b395ed8bdbeb8a658be0e2082c9664eb16264d", "object_relation": "sha1", "Tag": [ { "name": "obama176", "colour": "#63A968", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652136694, "uuid": "75530df1-4640-478d-8a40-564803d2ffcf", "comment": "Malware payload", "value": "e96dc19205028535aa614db4704be35ec0c23b59858b46a217f9fc6bc2e255d1a6e6ce66a4d39706e118847cb39609fc", "object_relation": "sha3-384", "Tag": [ { "name": "obama176", "colour": "#63A968", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652136694, "uuid": "847bbf56-dad9-43c1-8ab9-f7ec12def9a5", "value": "T10D6523388CB8C4C2EDEF813A10406FFAC3553D6798D485BE0F473ADF2866675A36645A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652136694, "uuid": "fce203b0-0145-4f4d-882a-9d48636345e8", "value": "24576:LMMok4+D/HMoNYIPeuVe2HHCkm6CyIwl6hafINeWHWR72fMMok4+EWFBGcMKSWXz:Ln4+NYSeQHCkXC/wl6LcW292fn4+JjM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652136694, "uuid": "b3478058-8491-44c3-b3cc-5a681676d368", "value": 1459936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652136694, "uuid": "be76b56e-b3c2-4f5a-9b71-41119a036ec9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652136694, "uuid": "39463bf5-d4ce-402c-a61a-cb21857baf21", "value": "63790f11728510ba60e1c151c3502f53c9628ced58e58ecafe6ce38d6acb5627.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8ef191-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105433, "uuid": "d311d424-f441-455b-a9ed-fe3f89b7997d", "comment": "Malware payload", "value": "b2b4e375a308634a2ab9d68f442577b6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105433, "uuid": "8ab6c8e9-fc0f-483a-87c4-59cf4ece7541", "comment": "Malware payload", "value": "63db4c0f91f0c1b71a054b99a5e86828052e21f4d3cd3295f0f421857fa3f529", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105433, "uuid": "57628e6d-fb7f-4d19-bbf2-8805032a5062", "comment": "Malware payload", "value": "6b95333b7a029b7341d1af65955d714f47394fd0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105433, "uuid": "aa7596db-a82b-46f8-a078-d3931ecb3cd1", "comment": "Malware payload", "value": "5d3a72ea6638e97ffd9285d0a5ce2a3c5619b5337a0f3ebd5f9214cbfd7a6ca0ba4d0fe08a32ad2b3ee5a9e51c55d110", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105433, "uuid": "16c2c6ec-64c9-481f-81b7-05e6da49f938", "value": "T1DE82376826CDAD32794A66E63FA43D223F244B874F5A9B7E502C8C1A047CF54D33ADC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105433, "uuid": "9dbb6ca5-c1fb-4d74-9341-424de1294c76", "value": "192:V3O2sheUI6Bg3RZUJxSUJl8nEkd3ZK3rZL1kbOZKFukb0c:V5sA16W36x7n5kDukIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105433, "uuid": "7d194108-08ef-451f-8471-c44acebb5090", "value": 19318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105433, "uuid": "029d71a1-0a27-4143-8e14-74413a5f778e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105433, "uuid": "2f8e612c-74d4-4fda-83dc-47c39c3c08f0", "value": "Info_Relev\u00e9_fiscal.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9947fc34-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652107068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107068, "uuid": "0383e2da-928f-4bfc-9231-68811ba1734f", "comment": "Malware payload (Loki)", "value": "4a290fd9524cdef80915379263c5d1eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107068, "uuid": "736aac15-ab7b-4429-8a48-0827231eef32", "comment": "Malware payload (Loki)", "value": "654cdd074d23cba1cd65f1803a206a0f9ca7fd7fc3905a4427ffd36a8059024b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107068, "uuid": "1cf6079b-c45d-4c83-85a2-8023fec5a76b", "comment": "Malware payload (Loki)", "value": "de3a266d5dd3dea2fa4af73131316ac1ae67151d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107068, "uuid": "782fdaac-3f0a-4ed0-88bd-17e1f520021c", "comment": "Malware payload (Loki)", "value": "1dfe150f9b63a0447e091ab735e718ae3c0efc82fdc23a5bf5bb907ae06871e49906bf4b666fbdbb83bbf87cf505c3ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107068, "uuid": "5fc2bd01-8bba-4566-9176-a029a258c1a1", "value": "T12CF30210B7ADD463F9F215326E722B797F9BDA0A213543473364AF183D32A439A1E391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107068, "uuid": "15ea94d4-94a1-4494-87db-623e35b87534", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107068, "uuid": "311b9c1e-9663-4cf7-9f92-274be76848f8", "value": "3072:l1NjcVVnLpPunbonl7gtmsSSPiSwIekoHvcMXfIYnSzbXz0JuG+wOb1ohQ:HNeZmonVgSS6SwX3ZXgzbAJuhb15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107068, "uuid": "81a8260a-96ff-4649-9fcf-3ba268cc13d9", "value": 159270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107068, "uuid": "49b0aa79-1a51-4a2f-a7fd-7e18799d010d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107068, "uuid": "1e7fc191-1051-488c-8715-a77cbd4e8e9d", "value": "4a290fd9524cdef80915379263c5d1eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a429a0a1-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652104510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104510, "uuid": "cbf73617-0f70-4816-93c2-ae70e46305f6", "comment": "Malware payload (Smoke Loader)", "value": "acedc4e2ce9f7a623418cd34185f045e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104510, "uuid": "780d5c3f-201f-4e8d-8cb1-500ab7df8387", "comment": "Malware payload (Smoke Loader)", "value": "6632832bbae5d8e52e15066b78ba36cf3db05029bb9813d5d403955a7781ddb2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104510, "uuid": "6fd06765-56e1-487a-ab97-a34dbd020ee6", "comment": "Malware payload (Smoke Loader)", "value": "7d7c918cb82cb8349d09c53d3a027e0e2eb495c1", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104510, "uuid": "9d99137e-869b-420c-b76e-32c8873490de", "comment": "Malware payload (Smoke Loader)", "value": "2992b595f9ac49dd70959a439ba199db2f2d774a7ede377a6795d2f81f1dfdc4980e67ac2f2944035c77ac39cbfa75f5", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104510, "uuid": "c7c9e440-ce69-4c50-b778-475a326e0b24", "value": "T1C7449E14BB90D034F1B712F4897A8768B93E7EA19B2490CB62D53BEE56346D4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104510, "uuid": "469424c9-d370-44d2-a249-d0f44ee19a68", "value": "529d9b6b5896743fc5398afc6b03836f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104510, "uuid": "306e0a48-4981-43ac-9860-510d691b687b", "value": "6144:mRzUsUkqbvFAbVSMiqfx6hTVjVn73nzNP22tJpuIGo:AQQS9yVSMpon5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104510, "uuid": "4ade138e-57c5-4180-a4fc-5e0c39f832ba", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104510, "uuid": "c16f68c5-ead5-46ab-b82c-ec8f3e99d74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104510, "uuid": "9d552cc9-1681-409f-b711-412e90d926de", "value": "acedc4e2ce9f7a623418cd34185f045e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e11b362-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652107264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107264, "uuid": "39fe6f5d-f2fa-4a2c-a73e-149c867a22e9", "comment": "Malware payload", "value": "918a5165e1f4c8496a0ac74ed5a05782", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107264, "uuid": "46797bfd-0050-4ebe-b6c2-cf77d4dcce0e", "comment": "Malware payload", "value": "669a477473dea30fd9229d79ab5a70af7c97bb9a9d6026d7537f723f0935c3ee", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107264, "uuid": "c8645d2f-f79f-426a-888c-27b4e2eae8b2", "comment": "Malware payload", "value": "66ffe33137a7a130d192fbf952d5c52df4028616", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107264, "uuid": "e0b8d32c-30e0-4e39-9ba5-cd2f4108e092", "comment": "Malware payload", "value": "febc6f38d7c54c94fdd09bf73fdd36c5efe0abb236e87a27fac8276e0f541254cc779f80d836d36768428816063653a9", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107264, "uuid": "bb31986d-b531-4e35-8df5-a8a2f51b9152", "value": "T179E633C3FBC715F5E98E083E18DE96166A356E120B31EDC7C784391528F27E09AB7264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107264, "uuid": "618eadfe-fdbd-483b-9dfb-602b944bb78f", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107264, "uuid": "8af2ac03-f34b-48d9-97ad-a9a5497b1b85", "value": "196608:Yd0MQoFRqOYdVCNqN+a+OQLynXmGTVxrMztBcQSNvwtQaafjxjjzLbJFQAmm:eVXqmNqIfOnXmGTVx4lOwtQHJLbTQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107264, "uuid": "196dee87-48c9-492b-9742-91ec518a2fb3", "value": 14399064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107264, "uuid": "90293df1-6e64-432e-ad58-d9ee90f09136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107264, "uuid": "76b7d9cb-842f-4392-8a16-5a334c1d9287", "value": "v2ray.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92d6c94-cf85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652093405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093405, "uuid": "d9c63191-9ce3-4278-999c-d4396b7c9176", "comment": "Malware payload (Mirai)", "value": "042d876c5cde66c2d559f7f021ae8380", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093405, "uuid": "921e840d-dbd6-466d-ae52-24b65bc56c4c", "comment": "Malware payload (Mirai)", "value": "675e506f7bce68bdf71317d6901d4fd13c2df9bc06b5efb3356c5bcb3a64737e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093405, "uuid": "7696bd4a-707e-487f-bcd4-e9f31474aa48", "comment": "Malware payload (Mirai)", "value": "68238d46f908997c2e44efff0290386d6926ccc5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093405, "uuid": "545a640b-a345-4a8e-8643-600ee6fe691d", "comment": "Malware payload (Mirai)", "value": "63b25710c335a7e93ad55955ba645e13e06aae8fa5b9d2012a51a553632f39cf8539835691c1049041ae9f8931c05495", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093405, "uuid": "1bde1972-be97-4dca-9347-a16a50c48ae2", "value": "T1C3F33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093405, "uuid": "c0927de4-759a-44e7-ae65-882e1cc9c3fa", "value": "3072:dUW6GNytZhMwZh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVytMSSuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652093405, "uuid": "697abcd7-190f-4f3a-8a1b-bdf7f130e902", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652093405, "uuid": "4316cb5f-cfe9-4cb4-954e-ee808bab59ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093405, "uuid": "82c63db1-8628-430d-a700-5823bfeea2c6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e24459-cfce-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652124612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124612, "uuid": "f3dd855d-2423-418a-b7aa-6e0f7cf11dc4", "comment": "Malware payload (RemcosRAT)", "value": "a35eea9e44f07e715775b802619dd85c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124612, "uuid": "fe5f8762-bc55-4e05-9e9a-c4c406284533", "comment": "Malware payload (RemcosRAT)", "value": "6834a76aa10ac87def06fa647cc9f87f6bc5e490060f0763c3eb62551c713f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124612, "uuid": "4d944b8a-19b8-4db9-8a1d-e3a5ca618efc", "comment": "Malware payload (RemcosRAT)", "value": "db3971284ec491d423fd0919710d8d7eebaeac3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124612, "uuid": "990d1b0d-eeb7-4114-ae91-7fd92446bb3f", "comment": "Malware payload (RemcosRAT)", "value": "a0349c3528926122125a6217c1db3b8c2738e98599a6ec780441fc010224ee5b98db330f34924450c01b8925bede59d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124612, "uuid": "1fcfc639-8203-4b08-8605-38070edef916", "value": "T1AEF48D66B2D04833C13619794D0BB6B76D3AFE102E29AD8637E56D4CAF3D6C03935392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124612, "uuid": "6507d46e-b964-485d-8ecd-199013ce778e", "value": "8aaab755596d4e153deff3d89570bbae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124612, "uuid": "64bf9ac9-fa34-4aa0-b7cc-d42d3be0bf3c", "value": "12288:8l9yyrn6OMyZINEg+Cu9aZvofn7EqNNY0ENwMeBAFCvU9r4FKI4/8:ClLRZId+d9aZvcVLOGHswJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652124612, "uuid": "0fdc6b51-060b-4c8b-81c7-9f2deb1832ca", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652124612, "uuid": "8a10c406-4407-46be-becb-b8ff98eb0faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124612, "uuid": "47704fb7-48f6-4f10-a4e6-1e73ba42f877", "value": "SLTiDC-Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e956877-cfd2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652126405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126405, "uuid": "9d2d95fa-ad01-4c5d-aa0a-b445b45c2036", "comment": "Malware payload (Mirai)", "value": "6c81898976a0af1ea8a591c3f56d12f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126405, "uuid": "22614ca4-a1e8-4e87-a18f-ab42f5f18fb1", "comment": "Malware payload (Mirai)", "value": "690a04716264bee5df909fc5c9ee4465267de2109473548d465131ca3c720562", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126405, "uuid": "2aacc9e5-b0a4-4f0b-b6a4-e7da2e98d5b5", "comment": "Malware payload (Mirai)", "value": "e360b37dd2ac97fb5423843411d4dd270612123e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126405, "uuid": "a69ac8cf-170a-4060-9a09-7a274f2f55cd", "comment": "Malware payload (Mirai)", "value": "6bd29e189d383faeb3c3de4e211f7daea33503acaa06103c4e47eee63d2e9c51c8735d782580719344d498a3ad9bcb9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126405, "uuid": "1bc94752-dd19-4c60-bbac-f09d2d9492c1", "value": "T1BDB33A4AEB808F07C4D51776BAAF42463323DB54A3DB73064928AFB43F8679E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126405, "uuid": "06da9a10-8785-49f8-98d1-f0b6b2492d1e", "value": "3072:z3E682pvRFGTSfXMCzACSGhhYq/yMM/9G8OmB:jE6HvaSfXvz/SoYq/xM/9GxmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126405, "uuid": "0af2bc9c-622e-4280-8af3-ba1f80c16fb1", "value": 114014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126405, "uuid": "6b9c4c28-7907-4030-8416-7bfdee0095ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126405, "uuid": "89407b3a-2767-42f2-8c76-f3ee01a1ada1", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec526544-cf97-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652101195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101195, "uuid": "587595be-da86-44fd-a48d-91c4ccc948a0", "comment": "Malware payload (Formbook)", "value": "87bce73178ebd33a85dad3aef87fdb87", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101195, "uuid": "3047df84-25b0-4002-a20a-6edcdcb9d5d9", "comment": "Malware payload (Formbook)", "value": "6a3848cae066ae561f1d72908524838d32ad7c95bc18eb155d44211b2fac44fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101195, "uuid": "62442962-629a-4e52-adac-e05e539abd72", "comment": "Malware payload (Formbook)", "value": "0f096b9d5243db5df6334f2ee48c6c36a85487f3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101195, "uuid": "57713a44-ee4a-4bcc-95d1-d426ba42a98d", "comment": "Malware payload (Formbook)", "value": "bfea01bddc00f989b07c589c55fb1699a7d49ed091292fc3e200f2d1c9789bd48f7c3ad7265a88bda4b8452ac43850d3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101195, "uuid": "b44c6624-7cc0-431e-a2e3-0d7c5e5ceecb", "value": "T1BB4551A3399F47F7DA260F51C26EF51014EE26BFBA8C8393D65275388B77181C163298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101195, "uuid": "5895b9a8-1eb4-490d-b5c9-611d4e7e9947", "value": "12288:YzaY6mbDrzsu10V9jTJJcDi1Zu54caUQanBfmb9GQ5l2bi8U4IZapUjSaG38AkxC:OOVu1UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652101195, "uuid": "135f7fe8-7ff8-4dec-82aa-a2a063310091", "value": 1185375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652101195, "uuid": "fae55dda-d8f1-4a9c-ab50-85dc29851aa9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101195, "uuid": "ed79be56-c7ce-483a-a6cc-6ed8e25ec0ee", "value": "JO.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df8ba95-cf99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652101708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101708, "uuid": "4677d081-9c3f-4a4b-a869-10405a3c2098", "comment": "Malware payload (Mirai)", "value": "e96e10f26a01fd3a78d2902cafc120f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101708, "uuid": "eeb5529e-822e-47c4-bf6e-4d9c0c0b64cb", "comment": "Malware payload (Mirai)", "value": "6ad0ebf4df10fee36fa01136bf8a26b21c8f560185dca38ebcad119905d00a0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101708, "uuid": "de39d01d-fe2b-4c2b-8cd9-127fe4d1203e", "comment": "Malware payload (Mirai)", "value": "e7a03df955117961210759bc4edfc426b77b1cb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101708, "uuid": "137f6a8e-27d6-4d83-8a6a-091174f26111", "comment": "Malware payload (Mirai)", "value": "6a5fc01ffb8b4aab981c81eff72cf5e67f3d7a76d937de0c34a81fa5e7171803cd4f6d1ed715aaa4c3d712b1e3bf1afa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101708, "uuid": "ef563bdd-9eca-44df-9b65-e41de050b352", "value": "T128144C46EA818F13C0D723BAB6AF41453332A794D3DB730689286FB43F8669F1E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101708, "uuid": "9564311b-3ed4-4b36-a8d2-1b73531f699e", "value": "3072:GlutC1vcncBIbqW+bDaw1uh4K+nG/lDVP4dbvbwmujT0uPxEM/9DrmywUWi9z:sutCxcZbwAXlDVP4djb830uPiM/9Drmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652101708, "uuid": "d8f2b0ab-84b8-42e9-b283-3978124ba771", "value": 190467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652101708, "uuid": "576c3436-9f5b-42c4-9bf6-51b91b0273e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101708, "uuid": "ac4b95c9-64e2-4cb1-9ebb-689e1c8df689", "value": "e96e10f26a01fd3a78d2902cafc120f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09e3874-cfa4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652106759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106759, "uuid": "78a9572b-afdf-4e58-b0b5-e5efe48712ca", "comment": "Malware payload (AgentTesla)", "value": "87cd2141cb704b454282fb935257cc45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106759, "uuid": "1a63c32f-4dd6-42a4-b872-adc45a7b66e0", "comment": "Malware payload (AgentTesla)", "value": "6c8f15101f052eac295764005192b7ebc68ee65fbbcda7e593eabee91c9cef77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106759, "uuid": "cf70c932-9d85-4820-beb9-6fc684f0ad35", "comment": "Malware payload (AgentTesla)", "value": "f1c7ed2a18b8a1218d489bb5f09e241bb39b4a56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106759, "uuid": "b973eea6-d2c1-4f12-bf18-d75b700ee88d", "comment": "Malware payload (AgentTesla)", "value": "0424543f4b582dc3c1b20e4de9750e46eda95db9cfd6a3753e8c90928b85364317c98f95c706a7a992cab60420c8bfa9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106759, "uuid": "247bfea3-507e-447c-b80c-9ac735769a0f", "value": "T192C459ACB12075DEF45BD072C9682C64A691766B431F42039833E39E9E6D6F3CE45CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106759, "uuid": "15ed6588-30af-4add-b40d-37550665a715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106759, "uuid": "132f2b5a-036a-43e9-9bc1-f01313e498d9", "value": "12288:tgjj+S6q6TMZoiRzxlV0umGYsdeEp/eWudKjGWQ6m:tgjj+S6q6TZuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106759, "uuid": "fa97b53d-fd0f-4d22-86ba-3d981ad2648b", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106759, "uuid": "ae72c3dc-bd9b-44c6-89cf-3197994c9a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106759, "uuid": "1a79ef74-da25-41e8-a4ef-bf3f5b056d32", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6978f61a-cf61-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652077782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077782, "uuid": "edaa87af-9de1-4148-80cf-b0d432ab607a", "comment": "Malware payload (RedLineStealer)", "value": "785a41d53ec0ad22881788c3d450adda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077782, "uuid": "be0b4175-06b4-4668-b4f5-930eabc59f25", "comment": "Malware payload (RedLineStealer)", "value": "6cc789c8938a07e93ef8e1b4a9d49de74980c5e0d2462be44db42b13e1ba8468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077782, "uuid": "bcacc171-484d-46c5-b13f-8a3b2ad805bb", "comment": "Malware payload (RedLineStealer)", "value": "e6d65da02b77302c1d20eecc44917533c74776c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077782, "uuid": "47954e6d-2614-4eda-b518-b7483e4c73e2", "comment": "Malware payload (RedLineStealer)", "value": "54953048dfe5b4ed812295563ccd9a001f7745917025c386e027494d3f8903c8e1c0f0722ab9984eaa31807cee2ed158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077782, "uuid": "87b3cd31-334c-4b59-874b-204dc02150cf", "value": "T10DE533E11F34E49CDDFEA172FBB5CAC8495580954AE2E79BD905F70B28E20134627B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077782, "uuid": "468e7e46-7e83-437a-b927-02c822e5050c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077782, "uuid": "fe4b4848-267e-4689-9262-c9115885c8bb", "value": "49152:Ht+sGUGEmy++65Nyqy9U+VaBpTGtrAeU4E+ydwnXW048YeDEc1jt6aYdNCkY+CJt:HHmyDiM99VYpaBktQnI83PwaYdQtyjdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077782, "uuid": "4dc1e232-4c8f-4fb4-8177-5d91b033ecb7", "value": 3112625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077782, "uuid": "12fd9f26-85be-4b6d-a3ff-5029c1c46b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077782, "uuid": "3e4f45e7-9d70-4929-a714-935c0683d304", "value": "84dor1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd19877-cfb7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652114805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114805, "uuid": "90bc8bcd-fcd3-4958-8edb-88db00bf4fca", "comment": "Malware payload", "value": "7f8d8107298c88d5ea87c87c41683d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114805, "uuid": "f54d8152-54c2-44e7-84d9-6bdda45a7cf6", "comment": "Malware payload", "value": "6d89c3404eae4685ff3e8cce3481ba4364401586d5ec2746a8a9b85fe5e6a5d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114805, "uuid": "ff07a3b0-7ca1-4b77-bb1e-382f18799e26", "comment": "Malware payload", "value": "01919c2574eca32c59c3d4bb1335caaafe529f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114805, "uuid": "9e6c7ef0-6321-449e-8511-16aab31cc095", "comment": "Malware payload", "value": "abcc3ed94efd5bf33f06061e8c258da660fe85537d5fd8f4e4e70fdb6a31e7744850a31987a773e945882c0403be180a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114805, "uuid": "a1c0220a-7dc7-4084-aa5b-e52ec23e0402", "value": "T150858D11A6A405E4D9BAD23C85674A0FD7F1B85113B0EBEF1B644AB61F23BD2633E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114805, "uuid": "ce41ab30-d8c5-40c1-8ca9-1dae61da0f9b", "value": "3c61f8f066772872d2185fba7d57fb8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114805, "uuid": "7cd224af-5a77-4977-b23d-b92a042712fe", "value": "24576:czD6plGDJYyf1UBZlW1MZ7PTcGEACGlZhtHMXgdLhAPXxfYzY1:4D6plGDJYR+KZUGWGlHLhAPXxfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652114805, "uuid": "653bdee8-77bb-4b51-b241-cde2623d29ef", "value": 1796608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652114805, "uuid": "5b919828-b846-4acc-97ce-a00dd829b7ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114805, "uuid": "605f7141-51d0-438e-bf4c-9b06b85b55a7", "value": "1775_2_86412912_01919c2574eca32c59c3d4bb1335caaafe529f3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c459c7f8-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652110577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110577, "uuid": "f6219a93-1ae5-449f-bd03-380910c6db7b", "comment": "Malware payload (Loki)", "value": "349a913f031c3fe4fcffbf57023b6969", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110577, "uuid": "a9258525-0b1b-443a-97bc-6e2939510078", "comment": "Malware payload (Loki)", "value": "6e2906921d11908152351c2a6add784896fcbdaeae44008ae156b289bd8a79d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110577, "uuid": "d2b68657-4da5-4972-9588-5afa8cf5b066", "comment": "Malware payload (Loki)", "value": "3b00cc478864cc5dd070d8ad90301895b995ded9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110577, "uuid": "2b412d7f-d4a6-4bb5-a641-334a2b366b4b", "comment": "Malware payload (Loki)", "value": "094bdbf2194a9c41e5c1971240cc7710ebf00abe59971b69e01ba479aa668e914dd75226ca9a30e232909f030e4491d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110577, "uuid": "8a81091c-5544-4ed9-b23d-9cb784f5d927", "value": "T1E6F3014636B1C8E3D5A20F755D7987A707EE570229B6560F23642F4E3D2A3C2DE0DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110577, "uuid": "b8572783-b1c6-4518-a7ad-2cb6014305c1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110577, "uuid": "f41780bc-755b-438c-aaab-7f5108c2f8a3", "value": "3072:l1NjcVVnLpPunbtj7Lvc4YPgpN56iEkgY6ztQFriLws/jS3IzUjhwHB:HNeZmtngxPgpNkivgVLTAI4jha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110577, "uuid": "fa395d00-01d5-442f-9afc-481ac7d43fa3", "value": 159335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110577, "uuid": "a0b702d2-e978-4c37-9dff-f55a93bbf6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110577, "uuid": "8c330c1c-f6ae-4b98-b23e-07a84a21b72c", "value": "349a913f031c3fe4fcffbf57023b6969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d28a390-cf7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652090754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090754, "uuid": "34a5f62b-129e-43ce-bfab-8047db3f7148", "comment": "Malware payload (Mirai)", "value": "00b6e03972395aa58012d48d4dd0a4f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090754, "uuid": "409ceee7-d4ed-46dc-893a-ffd35667b269", "comment": "Malware payload (Mirai)", "value": "6e5b4ed249a8075fdb5f9f644220df40c1a4f3d22ed28ddb43fba5ad77a6c6f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090754, "uuid": "4b0e8991-dacf-4db4-9d16-73817c40031d", "comment": "Malware payload (Mirai)", "value": "ef1d18c97c315e939b12432483b5814ecaaa0a9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090754, "uuid": "97fe0800-bef8-4f53-a7e9-027c70cf7488", "comment": "Malware payload (Mirai)", "value": "f24eb911f95d1a3742bd38dbba5a9a65044733bbdd2233fb8799140b92b20862793fe14a1f66a17fce8a85d95133de24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090754, "uuid": "b2a9c5ea-44d4-4b9b-9780-b63c1cf3a3ee", "value": "T1D523F746ACC1992AC6E0237AB56E50CE332173E9D1CF7667CC121B0077CA56F1D6BB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090754, "uuid": "62ed944b-7ab5-45a9-88ab-0d14a6ad4f1a", "value": "768:PI1liJ5PQcojYvrPW6OIuMQ4x8nTKSKw2DZTaN5FZSI/hr/tfZCJ9Dtz/BNHcX:iY3QWr6jMQ4ATK62DZO5F8I/d/tfYJ9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090754, "uuid": "e8922547-a9d2-4bfd-8123-4824beb3acb7", "value": 46308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090754, "uuid": "bfc60356-6410-49ae-b7cd-25d93ee71799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090754, "uuid": "8f9c197d-f2d0-4050-9ef9-964fa4a4b267", "value": "00b6e03972395aa58012d48d4dd0a4f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9149d4e5-cf8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652097177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097177, "uuid": "21f0b80a-f18c-4b6e-bc9b-74cc0ef94355", "comment": "Malware payload (AveMariaRAT)", "value": "08dfac88e9c3613f61610a305c8b69c3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097177, "uuid": "0da8c093-b4dc-461e-bbbb-227d18cf8570", "comment": "Malware payload (AveMariaRAT)", "value": "6e604a080ddaa906e8e74171c393bcea4af00c95e0d8c919e2838c08195078a7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097177, "uuid": "c78c15ef-23f5-4703-8c86-7da689a08b44", "comment": "Malware payload (AveMariaRAT)", "value": "400337de290c93ed81d89945211ebe3f7b5696bf", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097177, "uuid": "ecc41640-7a3f-4f22-bdda-cd7e5652f7a4", "comment": "Malware payload (AveMariaRAT)", "value": "cc67f89152c7fb457c92fd93a717f908ba0d1997cc3575bc4c37f03eb8876b377d69e9d5829709c8de941dc50f1e9321", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097177, "uuid": "ed7bdab6-d641-4751-b1fd-e8d0297ed0f7", "value": "T176F4BF22E2D19537C07225348C1B76AA6E3AFD102E38A94637E57C4C9F397D5393A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097177, "uuid": "0ae825d9-f4d0-4877-9062-4ff3a5b46856", "value": "8aaab755596d4e153deff3d89570bbae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097177, "uuid": "6438bcd1-cc88-4340-8dd0-0bbf38fa74c4", "value": "12288:8l9yyrn6OMyZINEg+Cu9aZvofn7EqNNY0ENwMeBAFCvU9r4FKI4/8:ClLRZId+d9aZvcVLOGHswJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652097177, "uuid": "197e9eae-55fd-4e0b-b377-afad83194112", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652097177, "uuid": "4ea725de-9a30-4ac8-84f0-ce84a2d8d6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097177, "uuid": "891c14d9-90ad-4e08-8fd7-a2dbe7a314ec", "value": "Payment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc77a20-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652084794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084794, "uuid": "14df80de-86e4-4927-8f2f-a7f865b08f97", "comment": "Malware payload (NanoCore)", "value": "8d3bc2b7e7f3ed6b146eb8f802ca50f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084794, "uuid": "6c25249d-f604-4b34-bf17-b7043b85015a", "comment": "Malware payload (NanoCore)", "value": "6e6791f54af734cf6c8a7c255df5f154881bd767a13b567bbc5b184187cf58eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084794, "uuid": "d67e4c64-2307-4889-9c95-95f5514d8ae6", "comment": "Malware payload (NanoCore)", "value": "aadebb338c1c32d90b6605a8d3875cc95a8a7c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084794, "uuid": "edbbd68c-c35a-498e-b718-0a67f05717da", "comment": "Malware payload (NanoCore)", "value": "71ea6717bf9b2bfb818e350b147c45ba43a9508d159518c74eff2a962614a2383512c3732d4dcb25b3342e19d0126565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084794, "uuid": "525185e0-1f51-4fe1-a490-1308114c7a99", "value": "T132B41229A1A35736E3B833F77DB401C263F3368AB07AF2E52D5522F445A274E5504B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084794, "uuid": "25199956-1027-4224-9faa-40eeee98242b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084794, "uuid": "0fbf5db3-b0f0-4e4a-9d99-c2d81040534c", "value": "12288:O2L2IsFBn1PHHsOkogWq3whJdmeug3ty40Jg2gMTnHu:O2iFBdHsOkopv0I0Jg2gMTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084794, "uuid": "f5c922d5-2df5-4aa0-a3aa-3cf1350b0029", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084794, "uuid": "b53adc4f-3aef-4c0c-a903-0288f2bfca96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084794, "uuid": "c04fd2c1-34b2-414b-9f07-c7b7ec0cb712", "value": "po-iteam DOO00076543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e304da-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652105048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105048, "uuid": "59a5cfe5-afdb-4c8e-ad4c-4aabc26759af", "comment": "Malware payload (AgentTesla)", "value": "3503b5680076a02ff88400eab456c55e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105048, "uuid": "a0a19b9c-dd02-4bb1-922f-91008bd4df8a", "comment": "Malware payload (AgentTesla)", "value": "6e8bcec8e9bda6ce2ffd235249938f9cfc7ea3c000e165374ae9f02ffdbae329", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105048, "uuid": "f3808648-d654-4287-8486-c486a78ceba1", "comment": "Malware payload (AgentTesla)", "value": "323f774e67353fd9b683a9b06fd7b497c95b37af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105048, "uuid": "9507ca02-76a8-4c8c-8ec0-d32718bbeab3", "comment": "Malware payload (AgentTesla)", "value": "bd05141189eafaed9d8eea23863959879146faef4f4eebc8cc8621a2ac007cf52b505a027e6f4c235529b8097c59d05e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105048, "uuid": "bd154898-82fc-43f5-86be-23cd8cbca651", "value": "T1E773E107AA6D8CEDE4183E39673D4B879767BC952D0B9344F2723E497738C388A505B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105048, "uuid": "ecd2cdef-6696-4a22-85cb-e2ef8345af2e", "value": "1536:fRCDUYzIjEMsL06Nd+QzJffP7XLS54Hx0IvXl7FbhhSax:fRCDVcVMj+QtffPjLS54Hx0IvXl7fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105048, "uuid": "c7bb68cf-7629-4042-bd08-31c86d920962", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105048, "uuid": "8834c624-c624-4b36-a0ec-93b83dd4e39e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105048, "uuid": "b2204a1f-1623-47b7-bd2d-792a63149dae", "value": "draft BL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a1486c-cfab-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652109477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109477, "uuid": "b7618d3b-3b15-4be5-bed6-401ebf009a0e", "comment": "Malware payload (AgentTesla)", "value": "4050e8008749fbe2a55748bd1c457f37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109477, "uuid": "5a1dc237-5370-4f45-8620-3470646b5ed5", "comment": "Malware payload (AgentTesla)", "value": "6fbd4fcdefd8d723ccc3da57c4785f0e467f0d568fcc38dda3224439565579ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109477, "uuid": "25332c32-944e-48a0-b9a5-960f90694252", "comment": "Malware payload (AgentTesla)", "value": "0c5e8a13e8fcd536c3215f9c0e8e0ddf7dcab4a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109477, "uuid": "8a07d645-b218-4eef-a7df-523268f81a4b", "comment": "Malware payload (AgentTesla)", "value": "d2f078bd845766607e48ea260868d1aad8371d0e546aca1c29d72a75a06d4a4255e4944bc78ee33b7613aeb2a566aa1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109477, "uuid": "c79c41f8-0c62-4ae8-b89f-1b022ec6d0d6", "value": "T183F47B28262CAA4DD07ADF700C43F13003E3686EAA52E6397ED37DBF65A2701C563765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109477, "uuid": "df1af9d1-1a6c-4225-867a-f060b1888453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109477, "uuid": "5ff9fc11-0f7d-42b4-9168-8e9f61b9899d", "value": "12288:roDgmUb1n+ya11AdvjWHFPJ4RAmGvTS3O1r5:pmUJnM1EYB4RAmf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109477, "uuid": "dff89886-7bd0-427f-9cc1-e47cd1e77431", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109477, "uuid": "bcf07963-0a40-4e8d-a18e-9637dd7c3617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109477, "uuid": "589aaef4-aa3f-424b-832d-cfceddb63fef", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84aa17e-cf48-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652067150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067150, "uuid": "0428bd38-9a5b-48fa-beec-ec9298d45122", "comment": "Malware payload (AgentTesla)", "value": "d440d9bc5e77f9827a4952757f22de66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067150, "uuid": "5a519622-b015-4382-8c18-86d132b8a3c7", "comment": "Malware payload (AgentTesla)", "value": "6fde41cc15fe0b8ca114dfbfed055f687d8d2883c734a7426719bd6a8037b958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067150, "uuid": "c0c93c99-21a6-4ca8-8d2f-727d84fb5a89", "comment": "Malware payload (AgentTesla)", "value": "935339cccf49b4ebc42bd5b1a8dffa8b88a6e3c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067150, "uuid": "2ea1feb3-3384-455f-8405-681738269aec", "comment": "Malware payload (AgentTesla)", "value": "2926f1f688e853451363d4d60c79b0bbfc938777deaa478c9511bafcaf697e98c75d7da88eab66e1b0b1ef998d6b87bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067150, "uuid": "6983b338-35e0-4612-a2a7-02087a68069f", "value": "T17DB4125962D41B13E53E0BFE3976660407B07C5B9B23E51A0CE720CB6D67B829A70F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067150, "uuid": "f0f576e5-efd8-4a1e-b70a-a4812ff3ebed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067150, "uuid": "b685931b-3719-4341-a7df-70040627ae90", "value": "12288:d/knyVn/WoAkxI/ZtcrjoarFtj74tKnSEmGpKfBi:d/knypgkmRtwf7xQfBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652067150, "uuid": "8d949092-5c4c-41cb-b710-a2b7c24db4e7", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652067150, "uuid": "78a3c50b-a55a-4ed4-bcb1-7b6bae43a138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067150, "uuid": "fff25ac8-d1c3-4270-b589-5ecc1ca555a8", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.16973.408.28384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0387307-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105443, "uuid": "acf5f834-503f-462c-bd86-181b50384eaa", "comment": "Malware payload (Formbook)", "value": "4436c17da6243ac8a54e75d73551a372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105443, "uuid": "407e974a-0473-4e2b-98b6-41b3e5289619", "comment": "Malware payload (Formbook)", "value": "7004038b720e2eab183b3cb5832661a32187f8d8c5f541dba61270044552fde0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105443, "uuid": "46ceb6cd-7f8f-4d17-be5a-02be4d3c0aa5", "comment": "Malware payload (Formbook)", "value": "5b549a9bcfce892fa4301c21d130ce15ec0ed8f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105443, "uuid": "3b36a84f-2bc8-4bc0-a089-2835fd3d9ba7", "comment": "Malware payload (Formbook)", "value": "9810e8bed4d3e05f8377a263c798466d09942137ce13b34eec55549848e6ecb5e9b60bb66893236cba56ce1818a18157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105443, "uuid": "ebb52c74-4e1e-44cb-a75f-3afcbc61e051", "value": "T1A0D41219BAAA4366D637E7F16460634003F72E6DB9A2F35A1EC037DF01E67620605F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105443, "uuid": "99b6d540-8391-4a0d-b910-5fd2cc3e5518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105443, "uuid": "ba47f30e-e5c6-4d08-86a1-4de806e56e77", "value": "12288:rXZp2L2IMe99HdGKUMXI8rUgAcj6S5ZO6+kMaaY5GQrwfJXhd:bz26e9/GKQ8rUYj6S5ZR+kMTJQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105443, "uuid": "1b303ba0-c92d-4f6e-b7b2-148ce06d065e", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105443, "uuid": "048e0307-da1b-4407-94f5-ed44adfbc6da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105443, "uuid": "da6d6b5d-a3d6-4eca-8fa6-09d535e82d9d", "value": "HALKBANK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a39726-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652058392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058392, "uuid": "eb39a836-bac5-4036-adcf-6527493ac574", "comment": "Malware payload (AgentTesla)", "value": "4a7e18e9648e97fb9e826afae9240a0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058392, "uuid": "38f86ebe-902d-44a4-ba47-a5e4b4061941", "comment": "Malware payload (AgentTesla)", "value": "7154908626fa2b2bb0da6b7085fa435aec82baf3e59a8f1e1fdf43994ed20a8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058392, "uuid": "27d118a5-0a2c-4c2a-ad34-3eb049c89b94", "comment": "Malware payload (AgentTesla)", "value": "dd690a1fea3b41cb69a01180c7a11e77bdf81e4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058392, "uuid": "95a951e1-4077-4685-a70c-42c2237eb22e", "comment": "Malware payload (AgentTesla)", "value": "0ddf0af92a6e5ecc03fe26255a394d478bc2e16c932d2f43d04c7b9ba600f1e10c753732cdfb67a7490cece08d498342", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058392, "uuid": "f1a6325c-5d03-4ecd-825e-de533fc16418", "value": "T142D4BF8A2388E915D1BE3730B69CB560C7F0B1CB9B77D35F6480A1D57772385AB806E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058392, "uuid": "2f88a2c9-436e-4104-83f8-e6cfbbc66da0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058392, "uuid": "fb2d7c93-1851-448a-b23d-6d0b4d061df5", "value": "6144:itsR7jRlHie6ZufgZXEG7YLRXf6YYUiB5EPrkpYi6IhQM9Ljxu5X+i5LBO:igjz4ZagOG7MR6YYfB+oYIhQM9xmLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058392, "uuid": "79892dc3-24d8-4d21-8f7c-4870b8ebed6f", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058392, "uuid": "dc8a5651-92f8-4087-a3d2-c5ecf19b1558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058392, "uuid": "7f850ac8-d183-43a5-aa84-068686291ff3", "value": "Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d39826-cfdf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652131755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131755, "uuid": "469a87e2-46e7-429d-8187-c169cd5e9cf6", "comment": "Malware payload", "value": "a85e8bf67a27dc2e4c53a098adca4802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131755, "uuid": "8153c2b6-97b0-4de0-b828-5b819e4e0dc6", "comment": "Malware payload", "value": "731adf2e11160b6cf67dc393dfd47d89f9e80b74e8754050a53b6ca51323517d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131755, "uuid": "8fc1abba-faa7-4182-9b8c-cec19b776352", "comment": "Malware payload", "value": "cf9273f5283a520d03a069604674f1a9ad776ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131755, "uuid": "82a6d447-0216-422f-84a0-302c33b9ae06", "comment": "Malware payload", "value": "fe8a9809cbeb6fb4818e720d62deacffcfd007744bf1e1ccd97ca1675f2288c4e027ffda60b073ba00ac98e0dd07018a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131755, "uuid": "613259db-8a6e-4da1-8520-b1cc91040026", "value": "T138E48E4071CDBCE3D06318F14E3AE72031A9FB6945AA864E31E27A1D95727833177E9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131755, "uuid": "f13180d0-466c-47c0-9311-abec5314a6dd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131755, "uuid": "a9d0c6eb-7c16-4204-ae29-d68e6016505d", "value": "12288:iToPWBv/cpGrU3yTt2lz04JhFX/WAoapIUI:iTbBv5rUHlz04JhFXuApIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652131755, "uuid": "a627cb7d-bd31-4484-9116-004d1f3f8233", "value": 716197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652131755, "uuid": "4e5bca38-3322-49c7-8948-2a75b223ed5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131755, "uuid": "00560ff7-8c61-41c3-898e-396035464f38", "value": "AccountStatement.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c19d7b-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105390, "uuid": "137bdc25-b364-4bbb-b26f-aedbc728c826", "comment": "Malware payload (Formbook)", "value": "e3cde599987cc9a8ff7f7d286175f9d3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105390, "uuid": "d621f0ef-f9ff-4816-a021-f1bb12608b04", "comment": "Malware payload (Formbook)", "value": "7480d003f1a50d543001fcddfd85cb6964749187b2777bd6b1df58eb010f1c4b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105390, "uuid": "ef76b35a-aa7a-4e7b-9567-304587564623", "comment": "Malware payload (Formbook)", "value": "15d625457c04620f07919c1bc0041d59d252e049", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105390, "uuid": "024989b3-a82c-4cca-ba63-a52a54caa213", "comment": "Malware payload (Formbook)", "value": "d63c613eeca3e644a13c82d63f89ffa09e5f90c6e2331afb7b20bdf2ddc94e2002210aad5f377ab51865fea922157697", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105390, "uuid": "f82e86f4-b086-472e-af37-5cf8471430d3", "value": "T13975394E670E8967CC40C6B9EDB62BA33767E7BE58835307A395373AC42B3BD1500616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105390, "uuid": "20c5bfbe-59aa-4fe7-ada5-a747ea3d1010", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105390, "uuid": "32c40acd-fd3d-4909-b4c4-53027dee6152", "value": "24576:eC6kMxtlE+bQ8AsssvVOzlFKYdQtMDKxJNvl8kbbypqnv:etrAME66kbIqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105390, "uuid": "0dbd09b4-86ac-4520-8b82-7853b45a3af6", "value": 1555456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105390, "uuid": "786657a9-46c8-4a27-bfea-4f23bd3076f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105390, "uuid": "03e5b3f4-0c85-4eb5-a35a-280f305375f1", "value": "DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a76bdeb-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652107070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107070, "uuid": "c016d400-94ae-4828-b96e-613ceb99eb9d", "comment": "Malware payload (Formbook)", "value": "79e9c3289512dcf95191dc0baab60773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107070, "uuid": "648f2e58-3cf5-43be-99b6-10220b4238a4", "comment": "Malware payload (Formbook)", "value": "7549b54cf11b85fd90163933c0ba384119890a3955ee26ea5fb7f5bf7267fdcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107070, "uuid": "daa36486-7745-4ab0-b0ba-c0bcc2e2d902", "comment": "Malware payload (Formbook)", "value": "0c702658063b03a7d01dffac5d52e49637d25db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107070, "uuid": "7a0b092d-aa64-471a-b108-792d035fbd9d", "comment": "Malware payload (Formbook)", "value": "e247c66488f6f3dea383f2a709dc88244cfdc9b8771fa17da5bad274da40ded3b7c68e372edfad594881e191beb1bfc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107070, "uuid": "31302cc2-7dc5-4dad-abf9-e2e1a891047b", "value": "T12822A715F65A8237D5650A318C6352E0567B7E1368339B5FBADC260E2FA73084D92FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107070, "uuid": "f366bbc9-d119-4fd9-ada1-09cf056b8946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107070, "uuid": "8a4794f6-c26b-44fc-be54-bf0fe7548494", "value": "192:hKYqeTXzDp4C0QWhzmACcVaJCUVVY1LbkV:hseTXXpj0QWRPEwlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107070, "uuid": "dad0191e-e60e-4d95-8c91-74fe1be55d8a", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107070, "uuid": "fb7d3df3-0db7-4a6d-9a59-109dd074d2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107070, "uuid": "342e2bcf-44bc-4ef2-8bbd-afc43e4c57ba", "value": "79e9c3289512dcf95191dc0baab60773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0d0513-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652109838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109838, "uuid": "5f55af7d-a0b0-49be-bf9e-bdd78a5c005c", "comment": "Malware payload (Loki)", "value": "246da33cabb2767f940892cb7c269b98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109838, "uuid": "067a7dbe-c280-4442-9697-f547270a82aa", "comment": "Malware payload (Loki)", "value": "75b449d3d1137d42ea8453185d612dea820f5fb375a0431072aabcdd5dd686c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109838, "uuid": "692979a8-1690-4565-a9a9-7063b4b98d30", "comment": "Malware payload (Loki)", "value": "e3bdd50c825ab595ef6f9817f2b9c5cf5ec6011c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109838, "uuid": "4c9ac75e-1e67-41fc-99ed-24821ecb95b0", "comment": "Malware payload (Loki)", "value": "4a25d3a6a6cd9aa026d6d2b5e16b875a15010e59ce853ed7b218692e504d7c13861b49a715ba2b157ed89a341307aab9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109838, "uuid": "f6c13944-6c6f-4a4e-94a3-e7528c7c4497", "value": "T1F2F3026017A5C5B7D5E703311D3756E2ABFAF13430785A4F0720AF49BA236C2A90F79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109838, "uuid": "2451a787-c579-4cfa-9e3f-1798ae894f01", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109838, "uuid": "bc8ecb45-30e3-4bf6-b918-875bcff59000", "value": "3072:l1NjcVVnLpPunb5s8T6Mmq28wpYDrwWY/nng79q56FUUXud1Nbt0+wjrHHg:HNeZm6MlvoOD1S49Qcudfbq+wjLHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109838, "uuid": "46af85e9-865b-424f-8b15-b73395108bbd", "value": 159250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109838, "uuid": "f8ac99e6-4fb9-4f2d-ab9b-18c04c4093e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109838, "uuid": "c5419ec7-ef34-4cab-98cd-dbdc663814fc", "value": "246da33cabb2767f940892cb7c269b98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744c7722-cf5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652076942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076942, "uuid": "b179e0c1-816d-4e52-999b-22413961bab7", "comment": "Malware payload (AgentTesla)", "value": "5a4defceaa520f3c4d8854f24d396325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076942, "uuid": "933385ba-ef07-4930-95d3-3a505333748e", "comment": "Malware payload (AgentTesla)", "value": "76c3fa85e70690cee90b3da765513a7b49e99e0d34375f1505a6dd93e6ef6a87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076942, "uuid": "911c0aa9-9288-4195-870b-a549255ddcb5", "comment": "Malware payload (AgentTesla)", "value": "1a9f121ceadcb2acf521880179993f16e81b9971", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076942, "uuid": "9305023b-4bb6-423b-8133-dc67bf817e3f", "comment": "Malware payload (AgentTesla)", "value": "2f2e4cc13b9524a0b436aeb8de1edb123f6f2e6809275a3cf2ec908f2e620a128f71322992b269295609f2b4712584e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076942, "uuid": "5d0aca06-ce64-47cb-9e28-b9d285849b16", "value": "T17DF4238AF957624FE4A2B7D20B8B322C48B55B251B546AD172DBCC7C85450D2F823F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076942, "uuid": "422efbd1-ff04-4a7e-9b53-febcbd27a7b2", "value": "12288:aCrFhsN67GBrEn/VYl1UeQmlQHGeRyg56hd/GS3KF3Ro0wLH+c9hkUMynnF0Jt:ZxhzGpiWl1U/zH1ahdOS3Q20GbnF0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076942, "uuid": "39d003f1-2b36-4be5-82d6-0beebee982ba", "value": 778179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076942, "uuid": "ab58b752-686b-4cd1-92f3-8818c9568c09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076942, "uuid": "ed3eb112-e86e-4b1f-a9cd-e5461fbbd0e6", "value": "PDA bank slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bf496d-cf8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652095978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095978, "uuid": "4cbf25f5-e81a-4f6c-a358-225709820c9b", "comment": "Malware payload (Mirai)", "value": "3d7e1e44dc3ad334256fba614c0bb007", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095978, "uuid": "66f7f935-7fea-4bcd-9ebd-2a635ac29f5e", "comment": "Malware payload (Mirai)", "value": "76fb9362a6e2da63dcebb50a8ddf41b27199735e37cc8bb955ec569f10836e94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095978, "uuid": "8f3f3b03-eb28-420c-bc70-ef4b5df9af61", "comment": "Malware payload (Mirai)", "value": "97f0fbc37e163fb70cb79d840060cdcd3f66774c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095978, "uuid": "d56308b1-f5ea-41b7-8f4c-d9cc16de0270", "comment": "Malware payload (Mirai)", "value": "0f36ab16dcbc6db87d8dda7a98da0650a399a7e54fc18816110d6ff2717e54f964a57d8a8b916561ecf579c2f4c6fe3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095978, "uuid": "714a6b91-8fc2-4b49-82a4-5afca20819c6", "value": "T19073A70A7E329FACFBA9523447F78E11AA5833D527E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095978, "uuid": "da8c9364-5207-4506-86a3-511288d503f7", "value": "1536:3IHb8FMv77EKQHlyQR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyWFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095978, "uuid": "fb31da08-1996-4984-b60e-9fe38c807bc5", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095978, "uuid": "82074564-4841-4ab9-99ad-806b42ae73b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095978, "uuid": "c094f7ec-7884-4ccb-b093-b32fb03bc3a4", "value": "3d7e1e44dc3ad334256fba614c0bb007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d4b200-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652058422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058422, "uuid": "314c6c99-3abe-4623-b123-1333c90b19d2", "comment": "Malware payload (GuLoader)", "value": "edbcd00935fbd210f964f9c120f7f846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058422, "uuid": "5f02bdd4-8795-413f-a215-897edf61f5d2", "comment": "Malware payload (GuLoader)", "value": "77127b6df6ffd79481ce20770c997a25ce8899e18b8b1c1923c1d675931e7cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058422, "uuid": "0b29e929-dca0-4a84-8837-0494db21891d", "comment": "Malware payload (GuLoader)", "value": "8add034e6660a6def36e939d6e5b401c3b6998e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058422, "uuid": "eaf2215c-49a6-4423-bc57-1c7d5d87538c", "comment": "Malware payload (GuLoader)", "value": "6e71d6321392c4d473655e8f6e1aee64abe95f4216be39fd509a3dbea91237d5554fce5fb869416aca8ddc2466b694eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058422, "uuid": "3c5b3f5f-9584-47dd-beef-79c9c8951ab0", "value": "T19D152317B86491F7F56287B0481A89521350AD37D6E1990F2384BB383CFB3DAF51A2ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058422, "uuid": "d79bb5c6-e5aa-4ab0-bf05-c3e97a9d15e8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058422, "uuid": "2cdf7783-1c66-4258-8b7d-2bb6fea8dc6b", "value": "24576:RYz2aMuMDZorg6ofY6qFEIV8r6qEyULgjpOqu88gc5l:uz2rpeg6EqFEIV8WqEpkVO28gc5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058422, "uuid": "b5dcfb10-430b-444e-b474-822aadc2e638", "value": 910528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058422, "uuid": "20dd81e0-ede2-4e9e-a5fc-e4bbca2064e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058422, "uuid": "cf50a9e1-555f-41bb-820a-077cf20cd2cd", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c9e64e-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130864, "uuid": "51515d20-741f-47b6-9e1d-11454413abff", "comment": "Malware payload (Mirai)", "value": "fb58f2b3c4818ee146de289ccb716c52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130864, "uuid": "56d70094-fe8b-4d72-8e93-f0f1cabcbe87", "comment": "Malware payload (Mirai)", "value": "77370507aab14252e4c97ffc429439fd34918c830b8f0bb55545390b278c3b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130864, "uuid": "bf288075-23c7-4a52-a046-1177d60738d3", "comment": "Malware payload (Mirai)", "value": "52a16652546c5c2a48594bea656a5969295ba1db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130864, "uuid": "93dd7a11-7dd6-46a5-a9e0-9dd6139097ea", "comment": "Malware payload (Mirai)", "value": "f9a092554aaa91c5cfd12ae499d9b78a72b3f8c0de65dd39cda55f585944f6510e38cc064a73215313b9cb5eeab609b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130864, "uuid": "30dd0e3b-70c4-4425-b65b-826980830c9b", "value": "T1D0E2E09D68A83CA9EECE483D12DD045AEC8B64A6035DDFC5233244C09E2F85EE1EC47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130864, "uuid": "65c49be4-6f86-40ca-8b76-164dd157ccbe", "value": "384:Z3fpCLrsjHIX69URc+hmnulY1qHprFKt6zNJpRwD9MH+Duvib2nhbJa39RWGVCzG:9fpWcehzJFYKn7gMHRntJa3LWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130864, "uuid": "00d08165-9871-487d-828c-8ac80dfb7dc9", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130864, "uuid": "50cf3bd5-8d75-46c9-a6bf-f414e946e607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130864, "uuid": "2e41dd89-102a-42fc-8a25-0b951e00d9f4", "value": "fb58f2b3c4818ee146de289ccb716c52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e3ad2c-cf3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kutaki)", "timestamp": 1652063415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063415, "uuid": "f2d10769-12f5-4e76-8c05-955b83ec783e", "comment": "Malware payload (Kutaki)", "value": "426530a6d99b019e7578d3aa0373d9da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063415, "uuid": "fbbc8ce1-b498-4ac9-8921-0f28954685a1", "comment": "Malware payload (Kutaki)", "value": "78917b96f538328e610b038d2f7ed877d64b1fba345071ec00161db94415a204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063415, "uuid": "e6786c7f-5e0c-4898-906c-3dfafda3ad10", "comment": "Malware payload (Kutaki)", "value": "d3be564f3cd8d9f56583b081f8f8c62515132e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063415, "uuid": "6f4efccf-07d6-4f0e-97c5-d752fd879e56", "comment": "Malware payload (Kutaki)", "value": "f8509937f0b52de0ba3670e2cfbe7d71260909503b40a77bb34500c86c71080508f48b09a69f52f97c3f886fbe06d8e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063415, "uuid": "40175c17-f861-4d37-8f3b-c8f44c2a6086", "value": "T1A2451207FB834A61EC6D6E706FD391D016A3B9AA1B57064FB740722978B0F912C58B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063415, "uuid": "75658c3a-e6f9-4a28-8861-fd74e5e18f5a", "value": "b5046d0cbaa5a4c738f3e5d31c133c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063415, "uuid": "684aad24-d855-4604-a79b-8ddfe69134c8", "value": "24576:xyM8JTmsOe46D5tKERWpnhNjQlUPnGYI5aDMcfmP/UDMS08Ckn30:YMsD46lgEshNjQmuYMaocfmP/SA8Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652063415, "uuid": "c93154f5-981c-465b-8704-05305b93f4e7", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652063415, "uuid": "fc38cd16-c7c1-4d4e-b7fa-467bfea06673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063415, "uuid": "a9f0848d-6a23-4ed9-b5a8-9e1ab9fbc1ed", "value": "SecuriteInfo.com.Variant.Symmi.62789.16418.11572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f12380-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105122, "uuid": "5aabdbda-b7ee-4074-994c-03b1be080d95", "comment": "Malware payload", "value": "bc812ecd58e1c3a8fd35c3ecd7dc7c7b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105122, "uuid": "6bfc9b06-a327-44ef-8b6f-6ba2d5350f4e", "comment": "Malware payload", "value": "78b3b7047188e1ebdd6b173f250abc3351ff58cfcbe95347e420799ade4e8049", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105122, "uuid": "53813f93-608a-4b69-84e0-165b971f4161", "comment": "Malware payload", "value": "35f166a88d2bce271170b8b8f1aafbc5210b34bc", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105122, "uuid": "311a83e4-a2ea-4d8c-a897-29dda4106b1d", "comment": "Malware payload", "value": "a3714eb2d00a23929d49b39503a58bc04db549ae915d58e835626ad6e74d9a3b23614cf425dc13112d739ee8ab49ae0e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105122, "uuid": "76a6556f-1dfc-4c78-8058-21e83a3fbd56", "value": "T1E0241269B6B9C54EE74A4F36F1305783A392DCE3B840E8485B85735C4DB948B2BE01F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105122, "uuid": "b656ba21-27f9-4ab9-b301-0682fe932c28", "value": "6144:h9IRX1RDjFGtK1soH99A/Bm99V6Q29LpmvJ:K1VjaK1sI99CBqVu4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105122, "uuid": "2548ad5e-c08a-4596-a726-e97aab82bff4", "value": 211496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105122, "uuid": "8b72cea4-e3ec-4400-8d59-b8ca9b10727b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105122, "uuid": "0c707db6-fff0-455a-8aac-04d0801b1038", "value": "RFQ_H71179 - 2022\u5e745\u67088\u65e5\u6708\u66dc\u65e5.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f080c7-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652107296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107296, "uuid": "090400d7-8144-4c02-9515-bb01415040e6", "comment": "Malware payload (Mirai)", "value": "2633be4c10431bb9368d2e7fc70b838e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107296, "uuid": "bc0c0613-a05c-4d42-b6ab-6d0e8f6b3be1", "comment": "Malware payload (Mirai)", "value": "793d54509cc85d11ac5a0575644b8df3e0224e08c0fa43cf9ecfb7b3ad24061b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107296, "uuid": "cad7837d-3b10-4a0e-86cd-df56d5882665", "comment": "Malware payload (Mirai)", "value": "9a629d5e8696201d33bf496017011cfb45922801", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107296, "uuid": "0c9027d9-7134-4a06-9750-54c955f162e5", "comment": "Malware payload (Mirai)", "value": "e37edfc780661d35e5ad9a07fa7df84e07fdf2b552b4f3e8dcbdf7b6029031a80cac36525ab7a8f0e484ad89553c4cb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107296, "uuid": "92a1eae2-a5eb-4088-ba75-3184f66dfda9", "value": "T1E0C2D08DEEE8789BCE9E6C7A818E46048989F0C175C757BD2BA54CCDE3395073A0D46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107296, "uuid": "a273a9b3-a20d-48c7-a7b2-a34b4a77fe97", "value": "384:uW+ETVLoV9mcN+pCgDjNl06viaEG2yd89s0rZkE3pylsHpW4son7Et6g+FlRWGVt:umJLomcAGaEX/9sIp4dVonU6fWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107296, "uuid": "1a5b4dab-59fa-45cb-9d39-aa0ad9f42fb6", "value": 27180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107296, "uuid": "a35d4d9f-c60f-4bf3-bdb6-71f2b74c28f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107296, "uuid": "50e6abe3-4cd2-4420-9daa-a5771dc57a3b", "value": "2633be4c10431bb9368d2e7fc70b838e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390b9f88-cf8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652097029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097029, "uuid": "2e703e08-d455-4c60-8c2d-460a30ebf817", "comment": "Malware payload (Formbook)", "value": "835db5d90e6b61109b927edc45c347e4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097029, "uuid": "97ff01a7-237d-427f-b790-0153358f7ba1", "comment": "Malware payload (Formbook)", "value": "79d4a9828e08dab4cdcc86c05947c39192031102c5e0a6c721554a7b779287e9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097029, "uuid": "3b11431e-a169-4a84-915d-93b94eed7f78", "comment": "Malware payload (Formbook)", "value": "040aa1b8a9e8e7962e5c79ec51bdcee3564bbd6b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097029, "uuid": "bc1f474a-829a-433f-b7ab-e61c2d3eab5a", "comment": "Malware payload (Formbook)", "value": "8d46233a215d82924f1212850cf96fb96cfa7cae8746f98441800c9b84d0dfa1ce78ae4143749c31f314ade4d248276b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097029, "uuid": "eba8b40d-3822-451d-a877-287f0f455a77", "value": "T10E24120C73162A93D7DC0B3607E3721873A0DD2A7B3AAB1BED76B20C59F08A4F155562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097029, "uuid": "af583c8e-ae3b-4497-87d1-136003e9e985", "value": "3072:zYfZ5cQSN8C2tnifZ21TCYJU78JuV4JThz8FdeycbabqBDzK4RnQb+bpqe9:c4NXfM1TCu48JuV4NAtcbabF+nQKQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652097029, "uuid": "30e42724-b8c3-4812-8a24-f8f6fe9baceb", "value": 212200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652097029, "uuid": "41dbb445-cb2e-47ce-98d8-ec64c662e635", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097029, "uuid": "402e4958-b8d0-4d2e-8f75-b5ec46cb6629", "value": "PO_0068048_05_2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb810346-cf9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104227, "uuid": "e46a2396-8245-4563-88c4-4d79bbd497d0", "comment": "Malware payload (SnakeKeylogger)", "value": "7f9080441ef0e7b4e0950d544e847d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104227, "uuid": "00a08667-608d-48bd-af0c-b7309492eba3", "comment": "Malware payload (SnakeKeylogger)", "value": "79e4a36b4788430d7ab6689fb53c4d913c0cf0745a6a2c2b080e5cd68a18db08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104227, "uuid": "648a8fc9-93d9-4b38-863b-8bb0d6b0fcb7", "comment": "Malware payload (SnakeKeylogger)", "value": "2117466ceec3e21dfece4081612894954d5fd0eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104227, "uuid": "e90cf996-b0c0-4c3b-8cba-a3364cece8b6", "comment": "Malware payload (SnakeKeylogger)", "value": "5d2aea98b3e04f8c836969e1730c338329530ba77bd87b59eb478ced5c9345ece4403fe29a59dd95813beb13d6ea3ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104227, "uuid": "c9ff25f1-1c93-4dd5-a54d-31c8224fab47", "value": "T1A7C412096ADE4723D37517F656A4020167F33E6CB4B2F79A5CC232DE29B6B080A02F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104227, "uuid": "f71eeeb8-76dc-4610-a97b-111a3428d4ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104227, "uuid": "f9f03081-1fdd-45fc-abcd-83c92c41982c", "value": "12288:KDOk2L2IIUxKZ+YwhAgwxM6+kqnOr3qrSVRfR3Rmkf1W0TN:Oz25KZBbgs3tqnOr3RzfRhm2W0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104227, "uuid": "029c618c-4f28-4572-8521-5a25c5fa4d59", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104227, "uuid": "3fa18c58-db47-4346-b176-f4d3b8164b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104227, "uuid": "6c3e5f0b-091f-473b-925c-3488bd5b8d01", "value": "Bank in slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e47b3e4-cf7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652089011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089011, "uuid": "b907e0a0-76c0-41b1-8cf2-2243a2b425bc", "comment": "Malware payload (AgentTesla)", "value": "f2705e3c2aa4568b5353f71147e0d884", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089011, "uuid": "54e574c8-c8b9-478a-922e-f8073f8398ac", "comment": "Malware payload (AgentTesla)", "value": "7aa78b8b25a4071d030ddc2cff3bb5230826b4da4ece46e1ebb70fe63b867814", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089011, "uuid": "9f38f1cf-7e47-4b24-bf2f-508a46f75b1c", "comment": "Malware payload (AgentTesla)", "value": "40786fc1fe392c25b937c155c3944612f29b3115", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089011, "uuid": "eaf4ec31-63ec-4097-ae72-8add1de8df4f", "comment": "Malware payload (AgentTesla)", "value": "a9282919c075c8073f857775c499901652f746524acad85798b9977a23a7e69863e097ba24131ac32cb5964b6baf12f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089011, "uuid": "8ca0bde2-670c-49d2-a5cc-239a7101210f", "value": "T10E049223B17CC5E6F89C3DF44A0997646AB46E920238F15BE94FBDC6E8B3223C2055D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089011, "uuid": "da11ff9d-e57d-4345-82fe-b5066dfde458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089011, "uuid": "ca3c1b31-30d4-482c-883d-054775d51c89", "value": "384:TJnktXewIm4v1liEHAHUKsMQmZjVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalfB:dkIpx3JgH2m5vqGsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089011, "uuid": "df0c6218-dfda-4b69-ba92-bdf678fc31f2", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089011, "uuid": "a0d12341-93b5-49d2-8928-f029958a09c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089011, "uuid": "26321f8e-b342-447d-82cd-c5d2eeac61b0", "value": "SecuriteInfo.com.Variant.Strictor.272345.25996.12615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c52993-cf7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652090722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090722, "uuid": "2a2d885a-84f3-47d8-ba95-115884517f87", "comment": "Malware payload (Mirai)", "value": "8015b1f3e036da9fbe5cc2bbc8c8b565", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090722, "uuid": "85f57112-ad5e-4a86-a445-d1ce22f9728e", "comment": "Malware payload (Mirai)", "value": "7c28244eb0ead7ae3c69f763ad254ba327fc29d8eec76cee7598afddebe72217", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090722, "uuid": "b12d30b9-6cc7-459d-bae5-6d150773f9d0", "comment": "Malware payload (Mirai)", "value": "4ff9b6bc802532e9de00ca2017df49dd86380053", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090722, "uuid": "30acdbec-dfbe-45c2-b939-56cb3feeec25", "comment": "Malware payload (Mirai)", "value": "274f4449a45570340b01ce16a77df1117f435e4731b6ecc451deb64cad17cd4d87ce04aa5c1a2ec81b8b46eae35c82fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090722, "uuid": "c44412d2-3859-4db4-a710-6877c1ba8d5d", "value": "T1AA735B21B9792E27C0E0A53B22F74761B2F1574E35E48B1E3D760E4EFF2098425936B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090722, "uuid": "66e19f3e-745b-4521-9352-a8f259f73931", "value": "768:DC7HyA5Zsof9ehs7n2LdKoaWMXmJbPLVGOKKFTO+75jkaDjT1tZzFBIM3:DOHySyI9ehs7n2LdKoaVchPp753tNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090722, "uuid": "d2c73b07-a58b-4579-9d8f-90cce988c15f", "value": 75508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090722, "uuid": "1b8ab145-0a01-44f6-9b6f-a31d902a6ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090722, "uuid": "b5c4daec-957c-40ff-aef6-b22cf84352a4", "value": "8015b1f3e036da9fbe5cc2bbc8c8b565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c10a8b-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652105096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105096, "uuid": "f2cca1bc-3771-4678-928a-08c25985613f", "comment": "Malware payload (Loki)", "value": "c0ef8570454b1c4b02d9f47933aa8211", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105096, "uuid": "4c53fc04-dd59-4e05-8581-980d2151db82", "comment": "Malware payload (Loki)", "value": "7db891ca27dee9aab6564ba3b787b34b950e27fedfe38f0b61f39dbda0456840", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105096, "uuid": "8446050b-394b-4dcd-9730-bf7e091a7a15", "comment": "Malware payload (Loki)", "value": "7efb3eecc4bf4200eea76c7aef4ee8ea876a12c8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105096, "uuid": "80ce3637-1209-41fa-96db-d08eff277bc5", "comment": "Malware payload (Loki)", "value": "69bfb374d0d641307edf7100e1b75cfad7fee5badb5c95c4a10ce82e8c70427f09103ad8b2c7db62bd4a3048c8f1c433", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105096, "uuid": "21ce8ef2-48f1-418c-b198-4685db37562c", "value": "T13E24124477BA7244E7FBCB73BD9AEB16E114EF026478602E3160F04B8B31759182697B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105096, "uuid": "27582e40-5d3d-468b-96eb-32bb312c2fdf", "value": "3072:uesoCSDzrFFVOYJvAfg6Jm9xGIN/hleU7nXK4sFtqatiJJZutGOuh7rMc0RA+6mL:fseDX3QM5NreUTa49aAwzYrT5EHGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105096, "uuid": "b8b2b28c-5b21-4f1c-af4e-cc4c80c77083", "value": 211640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105096, "uuid": "1ac012f5-1798-4298-a64e-929cc84e4beb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105096, "uuid": "73aae6e1-278a-4c54-849a-f24a41c9c6dd", "value": "Mt103 info.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ad9fc7-cfab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652109396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109396, "uuid": "e306b4f4-b511-4b2b-a7a7-3601fd66ac9a", "comment": "Malware payload (Loki)", "value": "de8ab426740f82f86b908139c01dce10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109396, "uuid": "4ed80086-b5cf-41a1-b87b-dc6aafca6e79", "comment": "Malware payload (Loki)", "value": "7dd1d1b1a03e383c5ef391c6498fee0144d9b23caac6f5668773f45b5d95f846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109396, "uuid": "26ce6232-e81c-49a7-a6d6-f5b97ec42c1f", "comment": "Malware payload (Loki)", "value": "72266ce0388219d679ee9c23851b2203617175dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109396, "uuid": "b0af538d-1687-4b8f-a155-7ae3100d5291", "comment": "Malware payload (Loki)", "value": "bfcd5a956bf1aca3f7e7f6b59e3eb18fd21fe96a06804d1c86cadc3f184ef16479323e3e5070bfe4439bb50877b37a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109396, "uuid": "8d0c45fd-2dfd-4d50-a49f-b591741cc7c8", "value": "T101B4121DBADE5727E33913F55261038543F33A2E70A6FB981EC136EE25A1B451602FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109396, "uuid": "dafe777a-7a74-46fc-acae-c1c0117cf8c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109396, "uuid": "e5f67610-e177-4c67-ba87-2eaf42a828c6", "value": "12288:Dg/sF2L2I98F2kCeenw4JhKgdMwt4AIRrxM7QZH:M424Ieenw4JxMwtwxMoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109396, "uuid": "9b75637f-2fad-4f7c-a914-e2d66713b474", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109396, "uuid": "435b334b-3c78-4b8c-9a4e-35cb5f8baa11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109396, "uuid": "25ac4b4c-ce3e-42e5-b81a-ff44290b8b9c", "value": "DEVOLUCI\u00d3N DE PAGO (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe58267-cf8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652095993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095993, "uuid": "9298f484-bc78-4f68-a31e-ccd8515ffd13", "comment": "Malware payload (Mirai)", "value": "565790727b289a9ee794c780a49a0b47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095993, "uuid": "dd98b50d-fe5b-489a-855e-4ca5e8d4664d", "comment": "Malware payload (Mirai)", "value": "7e42f00a1949d58ada6e0ec7d96b633998ab7dbdaf02aa339c20897175390bc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095993, "uuid": "6d948330-76aa-47d7-99e0-0a642aa0d47c", "comment": "Malware payload (Mirai)", "value": "2625502d56cdb8c243babceb0277dc35298e8969", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095993, "uuid": "ab9e1295-faf6-47ce-bfe3-71da382e248d", "comment": "Malware payload (Mirai)", "value": "12ae8cd5eb61b4400d3c3e2dd833903b74009085853d50b0ca92876cb308d2bc075768081fd126320e082f25fdf589cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095993, "uuid": "6fe663dd-2f78-4f62-8bb9-1149b8a9e219", "value": "T14B735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095993, "uuid": "2539f958-8d1f-4708-b80e-84907d69486b", "value": "1536:DNpp9RXI1vgi0uvx8zomz4KRyxOReqpNiSejOjNfXM:Xp9djCAomz4E2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095993, "uuid": "f6e38e4e-bdb3-4e23-a039-d2ae83b08368", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095993, "uuid": "4eafb0d6-5fd5-4101-b0c0-de6279d9fa3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095993, "uuid": "56dd5e7f-5610-40c8-a8d9-835725b74cc3", "value": "565790727b289a9ee794c780a49a0b47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd210e6-cf89-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652094993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094993, "uuid": "4a5e11c0-6955-48f8-a525-c1f47eb64657", "comment": "Malware payload (GuLoader)", "value": "c1009863fefd7a425639fe556a2611bc", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094993, "uuid": "ac3aa2d8-6ee8-488a-ae82-55c21cb014cc", "comment": "Malware payload (GuLoader)", "value": "7f03fbb1af60a62251813c4f05ae106d926413450990d9748a96b1e7f88d400d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094993, "uuid": "b63bc26a-865f-4ca1-8d93-bff12aca8674", "comment": "Malware payload (GuLoader)", "value": "8238c3f47cd97a210df54835f654202075f78144", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094993, "uuid": "504b793d-b285-4ac4-8e6e-3365dd6c7023", "comment": "Malware payload (GuLoader)", "value": "fa7e476fdee70acdb2b70bbe9880f3c95c42f205de1e430574ac09fe03cf6489ba65ed90615df84f9ac165b72d3fc115", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094993, "uuid": "913d27fc-9318-4097-92a8-f15326c24518", "value": "T1A4442347A0629FF0607B818E68619732E25F57E4AFEA4CC019F5D038A97FB569F181CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094993, "uuid": "5afbb934-1188-4f0c-b574-b24e32959174", "value": "3072:3NbWPhwDULM/ZlEZwiQFmjYt85uoX3vVi7KxVwWOGrZqnCMGT9RUQls8uOYs6+Dn:RWpwbZlEZ5EQwcmLcFl6slRFKDeGBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652094993, "uuid": "5574cd47-1c77-47f7-9177-dba00c720384", "value": 265519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652094993, "uuid": "0c8f9b13-fd46-4a98-97fb-fbf5f9666428", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094993, "uuid": "9c9fec5f-f5c9-4683-bc06-25be72bda675", "value": "Docs advice copy.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bbc786-cf98-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652101336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101336, "uuid": "3b66b36f-28a9-471f-9203-ce5f585c9797", "comment": "Malware payload (AgentTesla)", "value": "76f617508e8aa69ad0173a037855a2ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101336, "uuid": "6fc54dce-f1cf-4a02-9bd9-66e3b1f81a75", "comment": "Malware payload (AgentTesla)", "value": "7f0483f59e5629f1895a712107699e8c104cfe6c66cebdd6451d4ca1fe78d3f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101336, "uuid": "0515685d-f0fe-4b99-aede-b55e6ca3a4c1", "comment": "Malware payload (AgentTesla)", "value": "4263b94002845b358e6e24cac4661e85d41dd870", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101336, "uuid": "9dcbee22-ac8a-429c-be8a-a465bfb47380", "comment": "Malware payload (AgentTesla)", "value": "14521cc8a597efb5c2d271cf6379c7bdaa943727338ce1d5395e80c083fad6324bf6715aafda68b75d4f335eed5f3078", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101336, "uuid": "ba168abe-8dcf-464c-a72c-661e18081e5b", "value": "T132B4499CB12035DEF857D472C9682C68A691776A031F46039433E3AA9E6D6F3CF45CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101336, "uuid": "3b02ddcd-fab5-4643-9643-cd002eba9e83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101336, "uuid": "67ef9815-49a9-49a2-b7ad-765c937b0233", "value": "12288:SgjjEdA89QnPz/fvCC/HXkaniMTrettwk4Le+znK405VuNU/gPV10oTywx6m:Sgjj+/9g7nCCv86ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652101336, "uuid": "2fc9c83b-0e97-453c-bd7a-9d93626d4942", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652101336, "uuid": "94835bb5-e05c-45c7-bcf8-3d605d5a6666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101336, "uuid": "91ccca3f-4223-456d-b650-e4e9c06f737d", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e677a6a-cfb7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652114593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114593, "uuid": "1a87659d-b12a-4816-9c2b-0f360dadcfe6", "comment": "Malware payload", "value": "466967ec0dc2f08f9ea975676b2b09b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114593, "uuid": "0daa5823-9187-43cb-acbd-3b53092ff199", "comment": "Malware payload", "value": "8080af52447da94a3f6a19a21dde4615e21659914b8a352f0b489ccbb8e22063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114593, "uuid": "90bda35f-877c-4f9c-b503-c892a64952f4", "comment": "Malware payload", "value": "3106990172b7e645850b4a184dc4aa46464f9054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114593, "uuid": "cc9e6059-b0fe-4a70-908a-0e2b7c961324", "comment": "Malware payload", "value": "cbc5a132b8f3429419234be3934de688b5f188376cded6d89c2e155f218d0e9b1b09e09eb8762c563537bfea6e598167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114593, "uuid": "4a093f1f-89f5-4a50-96c2-41c3f56299df", "value": "T16535BF42F7D719F2E982093D40EAA73B9A3577150735C9C7D7802812B8E17E1AF793A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114593, "uuid": "48286a35-1260-4762-94f8-68f15965ebb7", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114593, "uuid": "deafb49a-be03-4ae4-bdb8-dc162e4d43c5", "value": "24576:r6T8Ujl6vO01C1GCTsYoQZtlsZdc40QDrUYuGG1ihTGTTi0CJcupMnSaTyV:NTUwTGTTWcu2nNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652114593, "uuid": "7a95eeba-bf70-4413-b4e8-2f3c7e0990dd", "value": 1060992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652114593, "uuid": "961cd7bf-3ce5-4e8a-9b58-45ffba5c5023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114593, "uuid": "1f1e1d6e-f5c2-42c7-812d-94c3cb9d1da8", "value": "aliyunssl(3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59924aa4-cf5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652076897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076897, "uuid": "1f832e07-2e1a-4d28-99b0-f6c33249d970", "comment": "Malware payload (RemcosRAT)", "value": "69952fcb36ea7b98b4e6e329aae836f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076897, "uuid": "6d9e2926-4622-475f-a517-b83acb6cd35f", "comment": "Malware payload (RemcosRAT)", "value": "81b648fca4135b631044dd68aee71ee704dcc930ae635658b9438585c5dc6b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076897, "uuid": "05256300-8459-4566-a0c5-361123d6815c", "comment": "Malware payload (RemcosRAT)", "value": "8f5911c4d0fad08a3f7f669afaf13e867a22950e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076897, "uuid": "143bba25-068f-4db1-ad64-fd0eb7a81087", "comment": "Malware payload (RemcosRAT)", "value": "151cb24855a78af9d9a634476dbcf841dc7021c4696de3bd0bebda4ca3b8afd6749122ee8942f0f75cc8855e8f825f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076897, "uuid": "3f577f65-8828-48d7-80cb-5f9c85031977", "value": "T10DF49E62F2D08573C03659748C0BB6A65E36BE203E74A8972BE53D4C5F39AD43939393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076897, "uuid": "3b31433b-ae94-4ca7-8813-b36fea35b094", "value": "8aaab755596d4e153deff3d89570bbae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076897, "uuid": "dcd90bb8-3bcc-450d-9731-b0acbab98464", "value": "12288:8l9yyrn6OMyZINEg+Cu9aZvofn7EqNNY0ENwMeBAFCvU9r4FKI4/8:ClLRZId+d9aZvcVLOGHswJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076897, "uuid": "09491b0d-16c0-437f-987f-78534c77b28a", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076897, "uuid": "3f21c8a2-20db-490c-a7f6-c7d83dd0ff4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076897, "uuid": "97ec6e7a-1be6-4541-91bb-4ba7a86403b5", "value": "RFQ_4200004864664899008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0624c352-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130873, "uuid": "903090d8-776d-4a88-818a-0d21f84b38cb", "comment": "Malware payload (Mirai)", "value": "a772ae63664a8fef2cad963e790cf5b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130873, "uuid": "3db0a3bf-ba1e-4139-ad6a-09a941577168", "comment": "Malware payload (Mirai)", "value": "81dc502962bbd31b059daa3c5c647849a726aa1ec767ddcdc22907fb8f021719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130873, "uuid": "b1144c5d-4512-4063-a196-0b9ebaa2ec9f", "comment": "Malware payload (Mirai)", "value": "3ec9d8e6c2e32f3b5b3eb04dfd2d12f19a72b798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130873, "uuid": "11bfe9a4-537a-4a7e-8c5e-6d2021198555", "comment": "Malware payload (Mirai)", "value": "d5d27d8eed1a5747999a9e5c955ecf3b800e224a81f3d0fa7508d8ffc44961dcf5caef539ccd91aed8aea563ff50cc84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130873, "uuid": "2582982d-4374-4726-bd86-333c6654acc7", "value": "T19AC2E271E20A8D73FFBEFEB08A41D9E23F46429E14A3E8D260957F15077283985109F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130873, "uuid": "bbcccfe6-c719-43bf-98f5-1cd9626beeb7", "value": "768:zjxqNa7PqLefxslATOTIAA6Q7dHGKKdPBKp0+OwFu4uVcqgw093:wNLaxsl8X6+dDePQw6u4u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130873, "uuid": "5be1bca2-92c9-4626-af47-c47466254716", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130873, "uuid": "8f605aa6-b1cf-4036-a79e-fcf9b45f98f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130873, "uuid": "9972cf41-0bd8-4514-a38e-cbb0f9a17495", "value": "a772ae63664a8fef2cad963e790cf5b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41304ac8-cfda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652129684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129684, "uuid": "a0be0f98-9754-4436-be5d-4f4b38b426ea", "comment": "Malware payload (Mirai)", "value": "648a32bbc45b1f9278c675914246f2fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129684, "uuid": "69e97876-44c7-4485-a847-24aed76f0702", "comment": "Malware payload (Mirai)", "value": "81e2f90f2be2da2c811f6bc0a916a85867cf89223080e39fe3fac808b3e87f36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129684, "uuid": "121f232c-a9a9-43ec-9b69-73ddac53f523", "comment": "Malware payload (Mirai)", "value": "468378ccd171a645772a6fe9894822072b60bd81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129684, "uuid": "1d17507e-a0e5-4557-895b-26afb599244f", "comment": "Malware payload (Mirai)", "value": "7ce86dbc5f8e735aa1e7cba7c1b93c32af7d59d98d915f8eeceaf9f693cc6f5fc17a576a7029be38b4c29431d959db65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129684, "uuid": "e535de8d-85a6-4c7f-9ca9-d74bb212ff41", "value": "T17B33741A7E319FACFB9C823947B78E209754339622E1D684D29CEE015F7024D741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129684, "uuid": "39fce1ff-19dc-468f-9472-20e8375fae3b", "value": "768:CBHMlknvQh0k4n1HLUeMkxXv/YtmiJHAbpO4j9GbjbsbPxbWbVxbPbrOA2g3G6u3:Pknm4n1HbXHvZGn2g3G6uH//+WaBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652129684, "uuid": "f637f6aa-507d-4370-ae81-ff3068d0a00e", "value": 51352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652129684, "uuid": "b1cba109-9c78-49e5-a604-1d33aa92100f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129684, "uuid": "a2e80411-cd9c-4a73-b131-dc5236d608fd", "value": "648a32bbc45b1f9278c675914246f2fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6956e828-cf78-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652087661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087661, "uuid": "2f0caa53-14af-4d1a-8395-e73c81db4568", "comment": "Malware payload (AgentTesla)", "value": "f792313d02acd7d78c6eff2de77a9887", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087661, "uuid": "1059a806-9f92-41db-a400-46ea79fc09af", "comment": "Malware payload (AgentTesla)", "value": "82520d655f459bf1e92179214716763191e13cf3f8de805454810a95ef688cbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087661, "uuid": "cdf82580-99b4-4a52-b1a1-bf4f6d9bf238", "comment": "Malware payload (AgentTesla)", "value": "b897cd3bdcf11382715a6b0002580a5991fbbf63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652087661, "uuid": "14a37e43-ab98-42ef-9ecc-64fc5dae05df", "comment": "Malware payload (AgentTesla)", "value": "5ee91cae96ceac862845f2baaff68102fa213641c329dbbed7cff41f0a7a80c99e5b16122ddc7cddc152e5ec8f8ca8b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652087661, "uuid": "c18d4942-56c5-4c9f-8b88-40e0e1da53d8", "value": "T1E5D423D33AF19331841C7B261C1CD635EE3810A9F5DB22DDD988926B8D6731C4EB5D98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652087661, "uuid": "29cb9fd7-26dc-4fe8-8cb6-487501f43df0", "value": "12288:l8KNNY/1RT3VM/qqcc7Zs7MzFcaCqG010ZO/Lb1E1yza:lpNYdRT3VCbcnWOa8K0Sb1ayO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652087661, "uuid": "5f26abf6-399c-4938-a72b-9c7b123963f1", "value": 629274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652087661, "uuid": "cd4b4eb4-6f46-4d87-ae29-670755a38613", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652087661, "uuid": "72d92fde-af5a-487d-a09f-544f130d71ac", "value": "ARC_ENGINE_ORDER_09052022.PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a1c3cb-cf48-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652067149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067149, "uuid": "12e37929-85a2-4488-83d5-871224988ab9", "comment": "Malware payload (AgentTesla)", "value": "b8b69993dda761ffacb18f6593e7f2d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067149, "uuid": "4e4ac6a5-8eb6-4f92-9f43-3b866cb697eb", "comment": "Malware payload (AgentTesla)", "value": "827c59f47ce022d9a4f2b51678d69f8adc22a960100187d2ed4a8b5bb7cae99c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067149, "uuid": "c4c580d5-3d46-4cc2-9398-3170a67c501a", "comment": "Malware payload (AgentTesla)", "value": "9968288c347c25aa5065e41aa29cdd68520101e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067149, "uuid": "ec653971-ed55-464a-98e0-45c278b914dc", "comment": "Malware payload (AgentTesla)", "value": "7b98c7e2ef4b33975a90aee870caebe2e54ed80187ec8244a24bb09d73e5cf9973e2755b9b85d3989f16fe7e6d1c52a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067149, "uuid": "546a01c9-c4c9-4b59-bdb4-120994a427e5", "value": "T134B42259B19C83A2E4B91F3EB473220413F0395BAA52CE4D4C9A54C42DB775E2B93F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067149, "uuid": "01de1127-4449-4f03-9fe8-233333fa7998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067149, "uuid": "b77c39fd-ba03-4b30-bdc8-5b9cd1007f53", "value": "6144:QaVOExVj3NQi+5s/rvI0unXuTSJicqARAGLB7bNY0kABh4Hz4Bu1BrsWXCujwBGH:AuJ+wrvIjneG3FrLB9W48Dr9C2w9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652067149, "uuid": "1e1b0955-5260-4a2b-8bce-85758d15f089", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652067149, "uuid": "301820f5-5548-4e7d-82da-55d7f4a51bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067149, "uuid": "646e680d-1a3d-402c-82ce-090a7ac28e3d", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.16973.2867.15586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c126c6a6-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652058602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058602, "uuid": "b0f70283-f711-4570-be65-bc90ced4d967", "comment": "Malware payload (Mirai)", "value": "fc4b25b0348cca68d4ec38ec33df6915", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058602, "uuid": "145887e0-57ad-4a74-bfaf-bdcec09921af", "comment": "Malware payload (Mirai)", "value": "835321c611491e067c7fb180426f2c8747c8c335e1c882cb32f1b94180b0aad3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058602, "uuid": "8132f98f-1274-4ec4-bac8-c2519d262002", "comment": "Malware payload (Mirai)", "value": "446d1c0d94afab446227002e8f9c18daa1444d1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058602, "uuid": "18bd49ae-9713-4b36-84fc-af86d64a7322", "comment": "Malware payload (Mirai)", "value": "04c9b34d6af20868fd4287bef0cc713c0cd6aa23bdfed78b6840b23eda8051da9d976cacedd77247c4021fead9cc91ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058602, "uuid": "347ae21f-ef45-4e44-ac95-0dfafe172ec0", "value": "T11263840ABF654FB7EC6FCC3749A91746258C641A21A93B397E34D828F24B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058602, "uuid": "d0898d90-5263-4ed1-a1e6-c2ed40600958", "value": "768:I+xGiJEEYlDIR99UEhLin8sSCVc55AexeAkejzxoNxpkkd5zXirCMsnqUG:I+xGiJxYlkBo8kVc4YdkEz/eFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058602, "uuid": "f47d39f3-5ee7-46ff-9dc6-868705fbd83a", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058602, "uuid": "5a0375e7-5dc8-407a-a28f-da8f2c8716af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058602, "uuid": "bb10f0e6-c894-4825-a6bd-6b1d99d920a6", "value": "fc4b25b0348cca68d4ec38ec33df6915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b96336f-cfd9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652129406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129406, "uuid": "7294e5d5-a842-4135-9dfe-3f7234cfc5ea", "comment": "Malware payload (Mirai)", "value": "8d811e95676ee354b9d17152f6ea0542", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129406, "uuid": "753e7883-aa91-48d4-826c-bfe7bb943579", "comment": "Malware payload (Mirai)", "value": "83a057b4d6920acdf568bb2e64e2d0e0579703e659c03225537c29b6a95ec23c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129406, "uuid": "7069458e-6df8-4580-bfe8-6c8bb94b5b08", "comment": "Malware payload (Mirai)", "value": "7d1243b5c2a0de82ffdf8ca4a7154cb3ae5aff70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129406, "uuid": "24ced3d7-89d0-4cc8-bd98-de0b086b93fd", "comment": "Malware payload (Mirai)", "value": "72c61c8fc73cd4f05949c65ea9a74fe0470b3a8ec8121abdb905879766323779446edeeb7babe0bffdcca391f61cb621", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129406, "uuid": "7a6e3c6c-8317-4758-a4b5-9b5eb608aee4", "value": "T140D2E154A7A4E870DF74573EFE3C4142221B13BBF4E8F5D712948949B64D60BD33A285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129406, "uuid": "7583db65-ea56-4a34-b6e9-4df718120250", "value": "768:9FoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZligETs3Uozw:9F2+IoXVeNIlzpzALE+zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652129406, "uuid": "18d39025-6d55-4a80-8b8d-435a3b399a34", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652129406, "uuid": "ad524070-9d5b-4b16-bd65-0c6c43eb593f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129406, "uuid": "3fedb657-d347-40cc-a8e1-51e06c4a204f", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2f2401-cf83-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652092387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092387, "uuid": "5ca607a6-8aea-4b60-8bc5-661524261692", "comment": "Malware payload (AgentTesla)", "value": "68860bba5bd5a6c1be9bcee552dd3b5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092387, "uuid": "c450993a-33aa-44cb-8033-0c097345039c", "comment": "Malware payload (AgentTesla)", "value": "83fa09296545f6336373523647d8f25711dff815fda58d5435126a8b0dd368bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092387, "uuid": "0e1ddc83-70e6-4a7c-baac-dc1b98d360f1", "comment": "Malware payload (AgentTesla)", "value": "966f889daf798820dc9bdbf2a2056ef9d72b6e3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092387, "uuid": "41914b82-5d7d-4165-ae54-1b150f2626f0", "comment": "Malware payload (AgentTesla)", "value": "9968e4e012c07bb6b9c187d6d919392997d1cdd49ad7faf50a324d9f9f65829d617fa9506db3ca3698dee78438f15902", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092387, "uuid": "7db53854-ab1c-4ced-97f9-d045a0e22775", "value": "T124F48B9CB11070DEF85BC671C9681C54A6916E6A5B2B820F5433F3AD9F7E5F38E01CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092387, "uuid": "f54f687d-e5e6-469d-9813-b135c1e5fb04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092387, "uuid": "cf2d3046-f7bf-4361-a961-11c4af5335f0", "value": "12288:7gjj8ia0hwPNwhj94q62vi2eukrp+Y+E5gx26kNkwDPgqsPqxK8d6mI4d:7gjjRS+6ei2e/1+Y+SLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652092387, "uuid": "aa08c36b-f40f-4f62-936d-691c6fcb1362", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652092387, "uuid": "3261f1a6-c9d9-441a-a33b-152da006f244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092387, "uuid": "08d87513-1882-4986-8cd0-166c70dd2e8d", "value": "Profoma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b606e0a7-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652084783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084783, "uuid": "e94c8e95-9754-4d09-ba4d-3542f59f1eda", "comment": "Malware payload (Formbook)", "value": "ffc4a0aa23f349c9d8e7bffc212807bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084783, "uuid": "e049d416-8c8e-40e3-8547-d28f25d2daad", "comment": "Malware payload (Formbook)", "value": "84d592767b553d06efe654049e16c7c583c0fa505f05b623dc508902d62b5a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084783, "uuid": "37fe9ab4-3273-4f38-a941-78cb028fcd42", "comment": "Malware payload (Formbook)", "value": "f31bc738bda34893f6a2f3801e224694cc0cf20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084783, "uuid": "39c7a509-0e8d-4fae-9ad1-f14e255ad481", "comment": "Malware payload (Formbook)", "value": "12e1ed643b33c616abd3dc33283b55fc8c5049320b0bb018009f8f25614c6ff70f0fee7cf7bfe951d1138a9fd2907a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084783, "uuid": "a87937fb-d380-4114-bbf3-7dc446ff3772", "value": "T1AF241261BBA1C8B7E9A79B325E768737B75B340408E6430F2350A78D3E62241F98F305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084783, "uuid": "0a7baa01-35ef-42ca-9c4c-5846284a8c98", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084783, "uuid": "d6224efa-c84b-4dad-a6a7-7d472b60129a", "value": "3072:l1NjcVVnLpPunbm18eXAENJmDRF3o/9E0UU65FHOYE2gPtTq6viN8BzgvSAdVvdK:HNeZm+RJSV9s93U1hOzOX4zgvtuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084783, "uuid": "be2115a5-dd06-4722-b1dc-9ac80806d257", "value": 219467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084783, "uuid": "333af774-7f2f-45dc-91b1-2db471497dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084783, "uuid": "69e29a75-4f17-4eac-9dd1-23943044e746", "value": "Fattura_855.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7799757-cf76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652086933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086933, "uuid": "8deeb185-c645-41f8-a62f-14f7c0357e67", "comment": "Malware payload (Mirai)", "value": "86f180fde9645da8fe8a31e3d8c73b7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086933, "uuid": "9c0708e5-a7d3-4991-889d-a232ba069956", "comment": "Malware payload (Mirai)", "value": "85d8fc8a84325468758accfb0b0171d22a50487991af95ad98a5f945ff717d9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086933, "uuid": "a7a65e3d-4694-45f8-acc8-956578d53499", "comment": "Malware payload (Mirai)", "value": "5760b6976770ec52e8d36738abeb0c270125e174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086933, "uuid": "4f473105-d768-4439-94bf-9f4b67f3ca31", "comment": "Malware payload (Mirai)", "value": "0276afbf99177cf25de80e44bf9e423192c1782dbb6851457a12969125b4fe64654936ef6d9bbfe2bf1809f0ca186071", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086933, "uuid": "d48b38bb-7f6d-49a3-a96c-c1865c1047ee", "value": "T19883D715FFA10FB7D8AFCD3749A90B0124CCA51A22A53B757534C828F65B64F46E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086933, "uuid": "65cf2685-33dc-4985-80eb-dd1496be5a49", "value": "1536:i0sUlwze8dpW524N8GmAbbKJuxZrYGnoiU+k0:i0sUlE3qbbK0x2iJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652086933, "uuid": "a284b54e-a43a-4806-b6c1-b2e533f3955c", "value": 80920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652086933, "uuid": "7ffb7bd9-6622-49be-bafc-dc1165168034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086933, "uuid": "7660d8e6-f5ce-45d4-9806-673efb35e307", "value": "86f180fde9645da8fe8a31e3d8c73b7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80adfb3-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652105483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105483, "uuid": "358deca4-0e39-4c79-8c94-2447e7f4484c", "comment": "Malware payload (AgentTesla)", "value": "9d7dc59c1b7f0812dd2be207bd8610d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105483, "uuid": "d037344f-733a-4497-93b9-7d276d30ec7e", "comment": "Malware payload (AgentTesla)", "value": "85ed3129d53674b028b5fb395a63ab34bf8af844094f4afda63d5c18f9dafd3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105483, "uuid": "a4b4338b-d6a3-4015-bd15-7b0a643a3f43", "comment": "Malware payload (AgentTesla)", "value": "7d03633a2aa597f334ce43b6bd6c97fc0080e03f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105483, "uuid": "663d8cb4-4143-4ace-9300-f28145b2ed49", "comment": "Malware payload (AgentTesla)", "value": "5fb3bd076a0f9af23416439c5bb5cb977a728a04b669fb207c5636f9c160e6174876959b35a376e6d424051c9fc9f55e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105483, "uuid": "6858d93d-3a78-458f-8db9-fd78703688be", "value": "T1CBB4124D788E6A27C6BB057EA1E3504153B048E7A3B1E64D8C9C59F2AF433C98E096C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105483, "uuid": "377375ff-cdd4-4aca-9a26-a9dd1f52942a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105483, "uuid": "2571c228-cb60-40a9-b0e1-13c5d824dcfc", "value": "12288:bqhA3ndgu/JsbZD9pKFIFedOZv5h16bRTpmqfyEnNh/ilNyeNhpW9M9+MMp13Yaq:ibZWFIFe4B5h161TpjfyQduNyeNhp1pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105483, "uuid": "3e2e3c0e-67b4-4bc4-b801-08d8fa97cdc8", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105483, "uuid": "768b1b13-ff3a-49b1-96ca-bceb7c1a696d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105483, "uuid": "ae962a31-b871-4d8f-ae49-f89934283a53", "value": "Bank Payment Advice-09.05.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f03fbc-cf7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652088428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088428, "uuid": "e33e266c-4324-4d2d-8caa-6bf2df0db2ea", "comment": "Malware payload (AgentTesla)", "value": "aeca6075f60aa51481509f0e0f96e7aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088428, "uuid": "be1096cf-42f9-4e4d-8b69-232d04f4bf24", "comment": "Malware payload (AgentTesla)", "value": "8648b35734167c919b94b4e69ad92bbd9d46637b50f62be5ac597620d42f5c84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088428, "uuid": "47dbe1b5-9c3d-4e8e-a17f-31931935374e", "comment": "Malware payload (AgentTesla)", "value": "931c353feff5df4960d09c5dd712678c274dcb95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088428, "uuid": "73e37494-3d24-4eeb-9763-44ff62a10ef5", "comment": "Malware payload (AgentTesla)", "value": "c7d53b12cf545ad2dd5585d84844e85dfbf257957f90e4636ba240f94b56d50f3c70ea6d2c1be8d5e95d7be18f9a5b3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088428, "uuid": "3c3107f4-b705-4d1f-91fc-24b1980732e1", "value": "T14CC4599CB12071DEF857D472C9682C68A591776B431F42039433E3AA9E6DAF3CE45CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088428, "uuid": "088a0522-048b-4fd6-86a5-1e757a2c2523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088428, "uuid": "5631fce9-dc5e-4f39-83e8-33bd0cb55e99", "value": "12288:cgjjdeiZtrjupuAhkvV1cVRWiK3gjVWsISS3wbJ9xnQgEi406m:cgjjMCcpuogc/WiK3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652088428, "uuid": "7b13e9e7-9a1d-4f9c-845b-8d969573b218", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652088428, "uuid": "8173a454-f0aa-4369-abe9-1df04490601c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088428, "uuid": "5081577e-90c4-41fd-8689-3b6ebd3868d0", "value": "roforma Invoice 49.500 M.Tons.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57855ca-cf7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652090768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090768, "uuid": "d6249aa8-e28e-4719-829a-8206f9805165", "comment": "Malware payload (Mirai)", "value": "095d6f96d6c7f9411c9083fed3c650a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090768, "uuid": "11aa6b65-ea11-4039-bcd1-abbc6f3f6c87", "comment": "Malware payload (Mirai)", "value": "86951e2e222cd111fae7764f6f03295187e25868e5974a4c79441a387290d20b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090768, "uuid": "aece9f61-b908-403e-8ee2-0292f9941f24", "comment": "Malware payload (Mirai)", "value": "8da310e0d4ca17faddfc72f313c07e694ef45b24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090768, "uuid": "fa22cb04-4ebd-4ffb-b7f1-de91676ec1e3", "comment": "Malware payload (Mirai)", "value": "8c4a8893afde19f5b0333c29cebaf0a8bff070c4dac48eee5c41a2228ad161eb4f3dcaa89ca5ba86bc0467ced3cb9f02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090768, "uuid": "e0a5cf27-3e77-4666-bca1-d55aabc0a5ea", "value": "T160831946BD819F01D5C912B6FE2E118E33131768E3DEB2239D109B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090768, "uuid": "c78c2ebb-5bec-4b12-ad83-e5812003432e", "value": "1536:CxnjOSuwgUtOJ8g0eoJWp0gNaIAEbSMDiYyom8Kxcl5kYG:FS09I60qaiyom8KxcliZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090768, "uuid": "7b946fc3-1385-4164-9817-534d62584cf5", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090768, "uuid": "362ccdcc-6aec-4b22-9bf3-e2ddc77dcc96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090768, "uuid": "414ead42-18e6-459d-9f60-9668b6620008", "value": "095d6f96d6c7f9411c9083fed3c650a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b6ba6a-cf89-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652094933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094933, "uuid": "e6cc1f64-0823-4408-8d3a-070f08b7e69c", "comment": "Malware payload (AgentTesla)", "value": "fe3ac298b53d548bdb4e7a3d29c1ea49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094933, "uuid": "4c64b13a-1a42-4d7b-9424-31157c8f8baa", "comment": "Malware payload (AgentTesla)", "value": "86e679c0c0bcd5e79208afed4ec26fe6372943fa8e2ff519da34bfe7b0e72c26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094933, "uuid": "b2c56f89-1d87-41ca-b7f3-a0ea85d2e3b5", "comment": "Malware payload (AgentTesla)", "value": "e0d82c2e78f308effae11d33aa74b9fcbad3e185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094933, "uuid": "5554de23-c72d-4e36-a35a-e73432786db7", "comment": "Malware payload (AgentTesla)", "value": "84ce8a5b2087f5b38f3d800d0da20192b1d43cebca8ee2dfe96277d1b0391a55547aa214d4fa02ad344d536b6226c2cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094933, "uuid": "fb24b3ce-0444-44cd-8325-78832979ea94", "value": "T19FB4124AB3E9E7A5C87D0BFEA471120663F465638853E5091CEBA0EA4D73B449F40F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094933, "uuid": "4ab37e1a-c949-45fc-94b9-cd3e389953b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094933, "uuid": "1f330c49-11d9-46f3-ab44-ba38b172db9b", "value": "12288:WZElPC4qMEepw3PF6L10bqgHjK9ONOxpfrn7IIiX8F+h6:WZE8dMJpoPwSbDHarc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652094933, "uuid": "5e2d8380-ad10-4636-8440-c3e9aa78a164", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652094933, "uuid": "bb8be929-2002-4351-af20-1412c6acee39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094933, "uuid": "86b6dbcc-115f-4c39-aa4e-b41cf754f3b3", "value": "Inv,Delivery note.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f29002-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652105152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105152, "uuid": "ad2a8f88-c8e7-442d-801e-06483d53ac9b", "comment": "Malware payload (Loki)", "value": "8b30dd860c6cfdbbe706865dde045126", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105152, "uuid": "11b6e582-6708-4117-9b21-ca9f091566a3", "comment": "Malware payload (Loki)", "value": "8789d990ad9f78bab7c87a108cc397087aa208a21f0ddf8eddb077bfe0ed6410", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105152, "uuid": "6ca101e0-efa6-44b0-9d61-f087928ace2b", "comment": "Malware payload (Loki)", "value": "b2d5260168ea5734da5fff2f62d697655c3052aa", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105152, "uuid": "806b3f32-887e-49e6-8e07-addae1b3736c", "comment": "Malware payload (Loki)", "value": "213d99e1dd8244c5a3cec92f32fffdb9b9d0dc26e1f1dba6039ffb20e94c568d25ef753998bda30d63508306c7143943", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105152, "uuid": "61e397d6-5b40-4947-926d-0fc0807d1985", "value": "T1C134120533763AA4FD98A97023B48C3B1032DF745656ED69730E36CA9DB27D6A902D0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105152, "uuid": "78d07e55-c314-46ab-bd65-aa933c55f853", "value": "6144:TeQQ/jIqvLcVkgczzpE3/5LLt5yAcilr7bl1H96S05h:T2jIMgU+kg7/YZ5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105152, "uuid": "b5d9bcb5-783b-4f79-a6d2-6965fa450007", "value": 241288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105152, "uuid": "32cb695e-945b-4f36-8a65-5b2420bd88a4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105152, "uuid": "911327f9-4b46-4572-a0a3-d5b86b7d3b1c", "value": "BANK SLIP+ SOA-CI-01 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138189ad-cf4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652069907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069907, "uuid": "6e439e13-0a66-4356-97ca-ad7bda483db3", "comment": "Malware payload (Formbook)", "value": "84c61a7293e34986b51bbe02160005a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069907, "uuid": "e2030786-95b6-43a9-a54f-4238b11521cd", "comment": "Malware payload (Formbook)", "value": "87945ecb2a81ea654a98c72800f03a4202873f30f58212cdec3d6d577be04d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069907, "uuid": "5bef26d6-342b-4ca8-8f3f-4d7faa8ef0fe", "comment": "Malware payload (Formbook)", "value": "7e790f1f9250c78afed30f1ab29f75269938dadf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069907, "uuid": "c7865058-e408-4b9c-9f2f-6015aebdecf2", "comment": "Malware payload (Formbook)", "value": "f0627d09134128cc3798b3e78f7d41aa191ec2a53e7e5c89d776e56e9586ce906f614c9015af543e11c71e36cb699992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069907, "uuid": "a48779ae-9dc1-45f6-a3a3-264bbe3e2ca3", "value": "T187C4F0CAF65496A1EC395BB62536C93012B33C3E9975E80C2DCF3CB73AB76519402993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069907, "uuid": "ab157e77-8124-43fd-af11-776d1940b3ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069907, "uuid": "ea2290c0-ad89-466d-a4c0-3a64dc725f5e", "value": "12288:9B+HUXPlo53VjOgA0/l9AX2+RZofoRnBcE:9BtXO/y10/vAcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652069907, "uuid": "a0830df0-0e57-46d1-ba17-8bf71c82ce5c", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652069907, "uuid": "789b9270-2499-4094-9b88-74ec298ace42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069907, "uuid": "78717736-93ff-4a1a-9902-57a61163b95e", "value": "QUOTE_8392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27f10b0-cfdc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130840, "uuid": "56f8f1ce-6fea-453d-b4f0-322b7277da8d", "comment": "Malware payload (Mirai)", "value": "1793cba1958c63d1f11595fd7be400ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130840, "uuid": "ac70a5d4-7ce7-408b-9177-01d83813eb29", "comment": "Malware payload (Mirai)", "value": "87c8aabac290db67e4ed7e5cdc5898b60753fe19b47e709088c647c2ac5de7f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130840, "uuid": "531c6de3-aa82-4091-b875-1c5d5db5b244", "comment": "Malware payload (Mirai)", "value": "1bb7228d3b0099eea3d9e0ad7776c4ede715dd82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130840, "uuid": "39eb0182-91ec-4a32-8d37-a5781059e8ca", "comment": "Malware payload (Mirai)", "value": "4133bb5105ce34179ebabaa46beefea1bbe18397b23ce2411f46427f5648e9f7692f9294bfe4e5fb115af9aea3504d42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130840, "uuid": "3c979fff-57fc-4d77-a7b1-76fa812f0160", "value": "T1D9034B4272680947D0672EF0363F1BD093BFED5024E5F6843A1FAB4A8136E774586E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130840, "uuid": "013f54aa-dd8d-4341-a34a-2b4b4bdf59b7", "value": "768:ASsN2HgycMkocCJrK0D3xE5A7s8iTK7gUnMt/:fTNkoc6uG3q4/MUnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130840, "uuid": "36085df9-e012-4301-9132-f024d9bdf135", "value": 38856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130840, "uuid": "28579f5d-5f6f-4462-855c-17f6480c5b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130840, "uuid": "3311533e-2723-4ddf-a8b4-c6fe0f8f1211", "value": "1793cba1958c63d1f11595fd7be400ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0458a736-cfd3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652126575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126575, "uuid": "29988493-f2ff-4a0d-bd19-929c24c8bce2", "comment": "Malware payload", "value": "05dec77dbc765b43d3b969146da92bb6", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126575, "uuid": "ba5ab034-0441-402c-a6c6-eb2b7878a603", "comment": "Malware payload", "value": "8888449dc9796981ca363c0fb9b1e877fe045902ade45966f4037af8eea3d198", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126575, "uuid": "6199b0ec-9253-415f-a65c-dd933a027314", "comment": "Malware payload", "value": "24a7022009444d5dce70514e854e424527b47f90", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126575, "uuid": "0b3776b0-29cc-4312-a569-847b22a94cb8", "comment": "Malware payload", "value": "5c18867b4935ee517b4141486e81d332b1e0cc1bb240f492b8bb940f0a798cbd4dc6f8cfb4a0a315b0171d90122edc67", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126575, "uuid": "05326559-33b6-466e-84c3-47ad7970c768", "value": "T12CF1834D71B6FB793566D9A0E9812988C0C6F0138CBB7F49B05EBE34F75E049F264628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126575, "uuid": "1cbe9f5e-9d04-4994-9106-98b53177976f", "value": "192:LuVJyjl0VxZlnIBabtMaZ2R4jLkZkekyk9dIGGc/j3qVCND:ug0lnIBabtMaVjLwJdeGcjp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126575, "uuid": "01877418-ee9d-4598-912c-6d28a8ecd253", "value": 7480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126575, "uuid": "3ab604f3-2919-4c23-a963-d21504d9e616", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126575, "uuid": "bd53902f-6681-4ca0-a3cd-de87f3625571", "value": "ldr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb7b5e8-cf8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652096176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096176, "uuid": "6ed00086-fdc3-4df7-b04c-bb765e7a6414", "comment": "Malware payload (AgentTesla)", "value": "acd4e08706ccdbf16bef80d2eb77197f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096176, "uuid": "a14afb99-086b-4a37-862a-fd5b9b0bf8c9", "comment": "Malware payload (AgentTesla)", "value": "89c3043b6c3b8c5aee763e2217e4f6f1398e19ee62fc0f038282d880ba1d4be9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096176, "uuid": "c8e93bf1-f0dc-479a-9fb3-d7114bf72bd6", "comment": "Malware payload (AgentTesla)", "value": "d984115c37348aa8ecc38ed2cf35e5cdb21d9743", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652096176, "uuid": "da2f4117-6bcc-436e-86e8-63b011f4a22d", "comment": "Malware payload (AgentTesla)", "value": "93ad0688b7a64701618f367d0f30a2d1cce53b792e11b794b1fe82c90f80cc5ce2d1af2794b46f17bee6d4eec96673ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096176, "uuid": "37f3efcc-a916-4eb2-a327-d6339de4e8f8", "value": "T1F9044C23B07CC5E2F99C7DF8861997641AB16E820636F18BE40FBEC6E8B3223C5055D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096176, "uuid": "0606213f-4831-4a6a-a3a4-14477ef76cbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096176, "uuid": "0f1ab505-c032-431f-839d-e93478f3e991", "value": "768:S7u2fr9j94psvFH619VGSZwk2m5vqGs0:SNf9TtqG3Tm55/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652096176, "uuid": "cf85b532-be44-4c7c-bdae-186bf2774854", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652096176, "uuid": "c7fdbc04-1ea2-4da7-965f-9f2febd37652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652096176, "uuid": "36ade81d-dfa7-41c0-bf73-62014a5bcb0c", "value": "SecuriteInfo.com.Variant.Strictor.272345.619.12085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5a4c17-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105461, "uuid": "c02fcac5-a01a-4cf8-b8f3-c11f0b6e385e", "comment": "Malware payload (Formbook)", "value": "1f04e23ebe111c048f7687ef0c0776a2", "object_relation": "md5", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105461, "uuid": "5600c62c-b6f3-44cc-86a0-68514080aed5", "comment": "Malware payload (Formbook)", "value": "8a10a7d039e501feb322fc8d7777353ce540f23ffdf76a402852106581334e56", "object_relation": "sha256", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105461, "uuid": "8ea84a67-7d99-4488-995a-a941638ed2d3", "comment": "Malware payload (Formbook)", "value": "40b00800457e00cb7f49b0312fbc145f7a72c4c2", "object_relation": "sha1", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105461, "uuid": "38d20f5a-0661-4f1c-89d0-53c0f2e9fe78", "comment": "Malware payload (Formbook)", "value": "91d266c12b50c8c2e65567b9b4f32e08b4759729a0e161f1693d3f724d7111870d6ac997d640790e581217c18eec40cb", "object_relation": "sha3-384", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105461, "uuid": "c9960781-e37c-44a2-ae74-9c54dd6e466f", "value": "T13BF42304B2E72F67DAB887F5619597805BF23EBD74A3F7482CC12ACE1897B540241E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105461, "uuid": "d6262af2-7a0e-45a4-b19f-f06a1f53605c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105461, "uuid": "53ae3662-8e32-4e9a-bced-865d076211dd", "value": "12288:4f1i2L2I5/UUGp1n0EZFqcc+Hs+qnqXjfU71fgQq3JLINKEEJ2Ts2Z63Erfjg6FT:E02qphLo+HWqbU5jq3JLINy3ErLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105461, "uuid": "332ecac1-c81c-4890-98d5-44ecf54707e1", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105461, "uuid": "107772c9-1a66-4438-9884-f3b7f975c366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105461, "uuid": "6d6d311a-6963-4cab-a4f3-4eba1f153649", "value": "SWIFT-BARCLAYS BANK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cc586a-cfaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652111519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111519, "uuid": "3dbb9eb7-350e-482f-b55f-b4105e0fddf6", "comment": "Malware payload (AgentTesla)", "value": "b351305b49b34d290644f9d2dd901bc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111519, "uuid": "7f9acbcb-d162-404c-9100-e0bceeb2d1ec", "comment": "Malware payload (AgentTesla)", "value": "8b8e12c78833f519fdf051cd71917fc408a892344dd12635704ae249df149b7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111519, "uuid": "240c1191-a74e-42dd-80c9-4757181d189f", "comment": "Malware payload (AgentTesla)", "value": "d3f4309d1ea8f5b29ab90ca7b8ce351d41abc22e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111519, "uuid": "dccc4ee9-09d4-4186-bce0-c83a798b0277", "comment": "Malware payload (AgentTesla)", "value": "989b1d65dc13563aad24f609d23a026f1b30c40a4df57ade9c716467e9e35880b9712b1eb4aceb86cbc55b63114eba62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111519, "uuid": "9be87002-b7f9-49d8-8d7e-be9e6954a00c", "value": "T1C905D0AC715576EFC917C6BADA982C68A760347B530BA243942311EDAE0CAD7CF144F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111519, "uuid": "4e6abda8-d044-408f-9173-414eccb06dd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111519, "uuid": "9e79ed32-9944-4e92-96a6-534d71890906", "value": "12288:fg2L2Iwsxj4HQ8rdlnJxToZ3jrFtU7o+e6XsNv8SDhZzWCqMH+OBWMjYUnrlAONS:o2fxsHQ8rrn76Thm7jCvBhuq+OBWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652111519, "uuid": "a7adf31c-36ed-47bc-99cf-72ef9560ff3d", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652111519, "uuid": "c13ad3d0-abaa-4537-8e16-5055cf676b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111519, "uuid": "b501efa1-10c2-4397-9e0e-c2255f8d288e", "value": "SecuriteInfo.com.W32.AIDetectNet.01.19489.13395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef833798-cfa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652108072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108072, "uuid": "a9b4521e-70b7-45ca-8b75-33d1725b95d8", "comment": "Malware payload (AgentTesla)", "value": "76d9b9dcd1ffbd51ec335937a6b572fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108072, "uuid": "271b4c29-f612-4849-a91b-5bd5ba119642", "comment": "Malware payload (AgentTesla)", "value": "8bcb5a572a83f02c665f153aacd61c38caf7103b54682c775b37360199224a32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108072, "uuid": "52f5e52f-ae13-481f-9d22-9009985f909d", "comment": "Malware payload (AgentTesla)", "value": "bf2927b04ca2cba6c438e4ac1b71d3fadd6cfb1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108072, "uuid": "a82a6ae0-2a70-4213-822b-2c5dc5f3dc60", "comment": "Malware payload (AgentTesla)", "value": "1015874f90c9fcf0bbf25edca727de0623eba78e3108fbc7ee9303d40930e680e51ae535f3f9c3278600e10b8dffd54f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108072, "uuid": "3002e134-3437-4f43-bbbd-74095a6b1a15", "value": "T19DE41286A9DA9B52D73613F1ED52820497FB2E1DB021E77A0EC4F3D924F5B150D04BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108072, "uuid": "cfcb33f2-ac89-4ed3-b8b3-4bf1cf2fcd62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108072, "uuid": "4cf9ec42-96ea-4cfd-915c-c0ae65fd0148", "value": "12288:mLK2L2I7QsQzyYCWk/VgFtew+g+j335FXgsxbmFGrtrQqZQQzf6SyVcyBwXd:p2P0PCWk2e2ybXgMmENucCSiSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652108072, "uuid": "9dabbf93-dc59-4f91-804f-437dc51d4058", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652108072, "uuid": "763d11f7-4e26-4d81-99e4-7eb968f08ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108072, "uuid": "507ae756-b216-4f8c-84be-ea796c627891", "value": "SecuriteInfo.com.Trojan.Siggen17.49659.5667.3327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8529c62-cf87-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652094263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094263, "uuid": "cdfd6b6c-303a-4ad6-8edf-25bda4c9a2b3", "comment": "Malware payload (Formbook)", "value": "19ee41d333996f2289255419efa2d4a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094263, "uuid": "c9e127b3-6091-479a-871a-5f2a6135f072", "comment": "Malware payload (Formbook)", "value": "8c585cd63fab6a0ccbc7bd9e5b5532a093248ce1cb893b8a7e825d8720fc1eb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094263, "uuid": "3c669bf4-da25-40e0-8ec8-0225a63943f6", "comment": "Malware payload (Formbook)", "value": "8a23a8957aa4880c3f0d150cb615d2d6e1934079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094263, "uuid": "4ec7e527-d216-483f-8629-0d608d226231", "comment": "Malware payload (Formbook)", "value": "3f442a64568fd45a6cd896f5e05d9e6e716fb19f040d076d69af3bae93b50f63753dfcab3e04ca7f9fe6019a2580a0ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094263, "uuid": "67053b85-23b6-4994-aecf-80a8e1e4e96b", "value": "T16223E86A288A6629C5D47BFC58B1A58321366CE00524C2CFF8FD7F29AD33623DEC515D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094263, "uuid": "881c3709-192d-4860-b1ea-3c2708b7e56f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094263, "uuid": "8064ab1b-5a01-4830-a02d-d5381f546ebb", "value": "768:GR5+8av0og2L1u7O2UcWvR6euxlmMwCK/3deVDR:U+8avBg2heO2jP630VDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652094263, "uuid": "9d9e639d-4575-4e36-9d6f-d6feadbda958", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652094263, "uuid": "0daf3241-ba36-4c4a-b789-05866464c260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094263, "uuid": "ac4b29a0-666a-4ec4-94ed-8190e2498b7c", "value": "Payment receipt z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6502a6-cfd2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652126406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126406, "uuid": "b437a660-8ced-4e81-b4fe-37ae57e13a41", "comment": "Malware payload (Mirai)", "value": "94756a8851d365202fb23f55f235eec5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126406, "uuid": "1994f481-2121-44d2-821c-1cd6ab915787", "comment": "Malware payload (Mirai)", "value": "8e48c43cac6ef2a495bbf2cdc1b9a33daefb6408c3b12ba4347a49df31eb5bda", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126406, "uuid": "9a199b98-7873-45fe-9a65-291583f23a2b", "comment": "Malware payload (Mirai)", "value": "9f58ebc5365b572486aea843ef24a13828eb071f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126406, "uuid": "2e397177-2d77-42f9-a8a2-5a9bc376180b", "comment": "Malware payload (Mirai)", "value": "82be0c89184d7ea3f7e99740184fa50a3d19b8b7b778e7d378585239b8c5c5e6d89f6681cc84fb9c2a984ad2285c94fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126406, "uuid": "931cdd73-870a-4a15-9403-6f7e99ca0674", "value": "T168F23AC9E983D8F9EC250A7120AAFB339777F43A655ADA83D3D9D532A842501E10338D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126406, "uuid": "e75b934c-f524-446d-8c12-4b5e5b10ebcd", "value": "768:1G8T6Qb3NQdU5WMDplOxiRYjItD/yafXnZD7/n9mJvLzK+1Aic:1G8T6QhQdU5WMLWid4uTIJjzRAic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126406, "uuid": "ce3671d1-2f4c-483a-ba00-debecb780d42", "value": 37648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126406, "uuid": "b46b9b34-b4e4-4b61-b986-42bea2374051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126406, "uuid": "2eef0d6c-5ca3-441c-9517-35b7e31cee5c", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72754d1-cf3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kutaki)", "timestamp": 1652063417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063417, "uuid": "10dc4d81-8966-455d-b181-d9979c7fb6b1", "comment": "Malware payload (Kutaki)", "value": "29a444fd62712cdfea44c8cb97d7b7e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063417, "uuid": "3a1588ae-9014-4e72-84a4-2909ae24f8e2", "comment": "Malware payload (Kutaki)", "value": "8ed0529363d69b1748385178a6e7f894652ab642d314a984ec19599d591fbdb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063417, "uuid": "f1c2f195-0564-436e-a7e2-add36ca03e97", "comment": "Malware payload (Kutaki)", "value": "027a76d7335c0070bbb2b085b6119ec3adf76547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063417, "uuid": "ba16d70d-d865-47ea-882b-fff20281fb7d", "comment": "Malware payload (Kutaki)", "value": "91e02229b9c8429f117d108c55348e19a9bda0f40414d6f40f0e4e00c99d6b325c302a854ec438abfac4e5f9faaefed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063417, "uuid": "9747fdc4-2659-4f3f-bcb8-3afbf13f115f", "value": "T17C451207FB834A61EC6D6E706FD391D016A3B9AA1B57064FB340722978B0F912C58B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063417, "uuid": "c0f763f6-05e5-4917-9fc9-6a3e5554a574", "value": "b5046d0cbaa5a4c738f3e5d31c133c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063417, "uuid": "1b8b8f10-a8a6-4f37-8648-6508d9aa3a3b", "value": "24576:UyM8JTmsOe46D5tKERWpnhNjQlUPnGYI5aDMSfmP/UDMS08Ckn3m:pMsD46lgEshNjQmuYMaoSfmP/SA8NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652063417, "uuid": "6fd27e03-c0ed-4ca6-8fa9-bb08e56a9cd2", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652063417, "uuid": "c754ced6-8247-44fc-b0ce-044b629a4593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063417, "uuid": "6b2de86c-d4a3-44ae-9f6a-9ff7b77ccafe", "value": "SecuriteInfo.com.Variant.Symmi.62789.26543.32407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7afad3-cfa4-11ec-8e58-42010a9c0032", "comment": "Malware payload (OrcusRAT)", "timestamp": 1652106700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106700, "uuid": "bbea1329-7a0b-4e93-aaf7-4dcb950e2db8", "comment": "Malware payload (OrcusRAT)", "value": "3cbbb9f92210df310b5b8a974bff35b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106700, "uuid": "72077454-b61d-47fd-b041-55aae0b205e0", "comment": "Malware payload (OrcusRAT)", "value": "8fa0c76caa93c8a47464600bbcbb3984fed0d2afcb9055389aad98fb254dcb44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106700, "uuid": "53eb6c38-e973-4ff2-998c-5981bea2c182", "comment": "Malware payload (OrcusRAT)", "value": "7f6968d1d22b1e4de1aa02b5a6c9c144b726f777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106700, "uuid": "2f98b092-f57b-4623-b46a-855f87eac257", "comment": "Malware payload (OrcusRAT)", "value": "1c9b54a3e1207306bd5531ccdbd2bd4c5ae071bff19508db2690af7b35005dbbd4094234f42e66835526eafdd2876ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106700, "uuid": "5ccd61da-6987-463f-83cd-30db83790b45", "value": "T1A90623E13241E6E7CE57973753EE4EA11171153AA538F30B2F98B3E81223B1F09692E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106700, "uuid": "4bf3007f-387e-45a3-97d7-5968e606179e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106700, "uuid": "37116b3a-1e4f-4d2d-9739-01d151e29b93", "value": "98304:EEfy/6iRYykMZkQ72XaLxdmFJfeKcZWV0ASSSVjZjD1f9pU:a/6iKyv5qEQZetuSVj91f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106700, "uuid": "81fa47ed-9a70-4aff-8b47-4f448e148d7d", "value": 3672576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106700, "uuid": "f85bb37a-41ac-408b-9989-d79dbc5796a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106700, "uuid": "b5d13a16-1666-45cc-ae44-e0106123e51b", "value": "3cbbb9f92210df310b5b8a974bff35b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a7759a-cf48-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652067153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067153, "uuid": "c025081b-4782-4f6e-9947-3877eca95b6c", "comment": "Malware payload (AgentTesla)", "value": "95c1e0aacbeffa8db023255c926870f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067153, "uuid": "d2756ddc-a63e-48f2-856a-7aed459ab567", "comment": "Malware payload (AgentTesla)", "value": "8fe6d743d2882ef8f20c4b54a16b7086ca29cd852b376d18bd5a49fd445f8a2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067153, "uuid": "de530dc2-675d-4d75-b255-152da187fc83", "comment": "Malware payload (AgentTesla)", "value": "b3ee832e6873f58c9b31ee369e6475ea39bd30f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067153, "uuid": "5a169171-fd6c-4bfe-8c7b-b5576ca399b7", "comment": "Malware payload (AgentTesla)", "value": "9c56b87a165add28b97216335512c7854ffbf8c8f9226feee8bc7ec73666a0f21dd3fac40337f028b1afdaa5996befac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067153, "uuid": "1075e4da-b52b-4112-bc01-196da184ff32", "value": "T1E0B4128D62D967A9D8BF0BBB9D32650013797C538A23D90C0CE724E9A9777849B02F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067153, "uuid": "e261fc9b-587c-42ef-8667-61e7b93020a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067153, "uuid": "353079d8-d250-46d3-aad7-0bcc942b6385", "value": "12288:pCWjzM8BNaOnpYlKlTepRnI8nRgLALRy9dX0ujPIHL3fL:prjY8uQAI6RgLALs9KYPIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652067153, "uuid": "a6f90d4f-5d7c-4947-9382-8ada71654ceb", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652067153, "uuid": "2b5d7b4d-2ba7-4cb3-9a1e-c2193d85d896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067153, "uuid": "fcee731c-590e-4632-9bf4-42ecf311606e", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.16973.6237.28170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150eb47a-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652105129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105129, "uuid": "8741d15a-6479-4c38-9383-f6826cf028ef", "comment": "Malware payload (Loki)", "value": "ae50a7a288ee98cace582643032daa80", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105129, "uuid": "aa941d22-f1ad-4840-9de3-0aa4c8c4bd9e", "comment": "Malware payload (Loki)", "value": "9060e802f5a6362dd078e7655b217a026babd635e215e93fc844610c3d9f6c1e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105129, "uuid": "63b9c0f4-3cff-45fa-8189-7f436ac793bd", "comment": "Malware payload (Loki)", "value": "e698d933f5f3f330787acecd5a5e7fbddcfad8d3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105129, "uuid": "55b8f44d-e483-43bb-825b-c5a54bec6284", "comment": "Malware payload (Loki)", "value": "52d77e42ddb098a1255c5712d98980d4323f4d285ef9be99f5948d9c101c603c6fd5b40ef628cbfc7f750da6c6118a01", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105129, "uuid": "23ad1352-9b8f-4382-baf4-924c363f2147", "value": "T1942412A8B7D26A4FF4D791BD1A829511ADF6FD031066630D67E7788DB630E8EF043218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105129, "uuid": "597286d8-22c9-43c8-a621-5ec18a4a43be", "value": "6144:mvtK8tXszi7wnd+TTWCVL6qRPiix8Ql+UHV:WtTXszf4eCVLzhtxZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105129, "uuid": "5d37f983-b5a8-4be9-89dd-b3d455a304e4", "value": 211496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105129, "uuid": "e5ddab1c-c1f5-4fd2-a58b-1b3fef9c4219", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105129, "uuid": "da6ba615-5fbf-4f39-b0be-f800e2be1539", "value": "RQ0849.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007f0510-cfe2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652133011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133011, "uuid": "6627ad0e-6dc4-41d8-9a4a-7726e294f2da", "comment": "Malware payload (Mirai)", "value": "32157adda4cd15284b60d6885f8aa25e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133011, "uuid": "fe5161e0-edff-4218-96cd-10b4edd36b84", "comment": "Malware payload (Mirai)", "value": "912d4115122c2018f180e4e88dfa876cf6576e9dc6fca0b30094ba8d23bfacbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133011, "uuid": "a9a8cc1a-60fe-42bd-9ba4-984eb946559f", "comment": "Malware payload (Mirai)", "value": "11c9d27f01520911ca186719c169de6fce45e37f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133011, "uuid": "cbe292bd-124f-4363-b7f7-6539fa99925f", "comment": "Malware payload (Mirai)", "value": "80a11fec103b2b28e2be5e20b22b91faffb8d442de731d7d2f71bc09b7575251ccdbb585192337d653c79dd7ea626dc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133011, "uuid": "87090b34-d06a-4fdf-97af-e0e7fdca7c7d", "value": "T1A1134A31BE7A2E17C5E4A4BA12F74729B2F1935E34A4C72E3D220E49FF00A84A5535F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133011, "uuid": "c61fed46-5052-449a-aeb7-48b188ae9925", "value": "768:uYo9tBD9q9psZmGPxTtCtD7ps/KzqWICO+0WcaU:uYEtBD9SpsZm2xctD71PvlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652133011, "uuid": "c77a7f87-9740-422b-90c6-7eaa6e071d1c", "value": 42336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652133011, "uuid": "5bc8bcae-4f20-45ba-a91b-8d077d4d2118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133011, "uuid": "3406493d-54d1-426e-a9b8-72b4907928d6", "value": "32157adda4cd15284b60d6885f8aa25e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef472d09-cfa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652108501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108501, "uuid": "24ba86e9-678a-41e7-8a74-78f3c541a923", "comment": "Malware payload (Loki)", "value": "2f16b84d14f2db18711e875eebc37bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108501, "uuid": "1294f032-24b0-428f-b41e-25ce21195d3e", "comment": "Malware payload (Loki)", "value": "9136bf8ebb145debee7e84212da910560998b675b7f68e279a3d2f2dac21adb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108501, "uuid": "d34d0c2b-a861-44ab-997d-41ba89a09031", "comment": "Malware payload (Loki)", "value": "236304379a6279a3f42732a5bb9c429b2fd38ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108501, "uuid": "f9f9798a-ce04-4793-b010-6c3ff3a2766f", "comment": "Malware payload (Loki)", "value": "5bbd77244d3a07452e276f936cd7a9b6a5e4ae0e3c4853227193267cc5639d0149e0ac2c07dba9fa0bc0f2ac7056c92c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108501, "uuid": "6586bab1-192a-4160-be4f-9049611e9fbd", "value": "T126941205B2E9C3A1E57A03BDA973110423BC7C976426DE5D9CDA74D629F3B45CA00FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108501, "uuid": "2e9fb5ac-775a-4ab8-8230-37b9cd51a872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108501, "uuid": "22c57d9b-5237-49fb-bfb3-1e61d5603062", "value": "6144:9iOASTppM3UrHLKricFhK6zbJ1AKlaaRALvZAxcrtu6lEMJ+Fv:NASTpVKrJhLzbvRlPRAFAxcBuYZ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652108501, "uuid": "97bda689-de47-4d1f-a737-c158e5e02baa", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652108501, "uuid": "72cfa92d-9710-416f-932f-f1bafbeae95c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108501, "uuid": "ddedd24c-84d5-4ed0-b0dc-52d5aca1e142", "value": "2f16b84d14f2db18711e875eebc37bce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83fda55-cfcf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652125186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125186, "uuid": "6bb1f701-affd-4681-9aba-fb8597e73ec8", "comment": "Malware payload", "value": "07ab0e48a422308845f035b12abf7104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125186, "uuid": "a79af7ee-a56e-491e-bd85-6caaf6e7696b", "comment": "Malware payload", "value": "91e66f0edfa5f0277e127b599517b497cf0204b181f32ce1aab8f9faa749ec40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125186, "uuid": "4a5829dc-9652-4e0d-80da-3e13793a2a64", "comment": "Malware payload", "value": "b231e65fa596852f951024a0dde394cf20e0f153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652125186, "uuid": "c7ccf6df-174c-40e3-9818-725096760e7f", "comment": "Malware payload", "value": "6781625bce9e44144b65e7802c2605b490df9ae051a13b04a4285779f489c9c0ac82e16d26675b89a2c69b7f18191b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125186, "uuid": "c074ac68-c32d-4ebe-afc7-2c188230a841", "value": "T1E5549E9EA20461F4E92FB9B0FD812636877121296336E71E4638CBE10EF1DEE7D151E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125186, "uuid": "124ffdae-6a2c-4502-82d3-45c7c34d7b08", "value": "93bafaecc9e323f0fbc33c522d8c634d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125186, "uuid": "20b41c21-267b-41cf-bf57-cc16c8faa22b", "value": "6144:He3Ic88TvqMZNMlnibi9jLv9P9kO6ChLv9P9kO6Cn:X4wntLl2+Ll2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652125186, "uuid": "5a9f1c85-78c9-4d5b-aef3-929618ccde16", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652125186, "uuid": "6c4132ca-d621-428e-b8c9-fe8f45813f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652125186, "uuid": "0c87daf5-bdcb-4ac0-bc4b-003afd2f7421", "value": "texi64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cf2902-cf6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652082603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082603, "uuid": "40c53210-b032-48cb-90b2-e0ffb08a64dc", "comment": "Malware payload (Mirai)", "value": "66543943dd4bf0349cbad3be5a502ba6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082603, "uuid": "1a91ab28-1aef-41ce-a816-5bc34706c214", "comment": "Malware payload (Mirai)", "value": "9424c20f94c3a968ec73aef49662f5b4443d4777237a78bb7e2a85b9fa280f26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082603, "uuid": "d5a6cdf1-5d91-44f6-930d-a9c6999f89e7", "comment": "Malware payload (Mirai)", "value": "2116933455a79bfd02ab4b0507e0800ca764fc8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652082603, "uuid": "279db942-87b8-4b5d-bee1-fbc8475600e5", "comment": "Malware payload (Mirai)", "value": "290defb865405ab96637bf7efd217a10964c64467cf762e7d1c4a3ac4a547a7c24ec59ffa9a0497874327b578e22dfbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082603, "uuid": "76495478-3284-4bdb-9acd-1574e074b130", "value": "T1FE633992BC819A12CAD423B6FE5F519E331213D9E2EA7207AD15AF2037CBD1B0E77151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082603, "uuid": "9c0950e2-f6c9-4efd-904b-d245456b640f", "value": "1536:HSknxe0taCIFK0xsSoxzhlwqB9xPAhyptiW/sHvz:HSovta1FZMuivPAhi1sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652082603, "uuid": "71294110-fcc3-4a3c-b149-028a11c4d99f", "value": 71988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652082603, "uuid": "82dc286a-c0d0-484f-9d50-21c411975288", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652082603, "uuid": "55b9cfdf-2d5c-4368-887c-4910c51eb8cd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d99c01b-cfbc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652116874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116874, "uuid": "33412369-cf31-4b86-b931-f2c946f514aa", "comment": "Malware payload", "value": "348af9d5fd2181579c460eebb73ef3ca", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116874, "uuid": "2e54ff2e-d5f5-4f90-94be-d7f12d7db973", "comment": "Malware payload", "value": "9447ec740c00035c0b0e6c32ea86cc4e7585477e5c97f353b42aeee9dafd9cab", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116874, "uuid": "3028bffe-f36e-4fbc-8500-91fe1bc049be", "comment": "Malware payload", "value": "9d6aefae4df99363e9d909dc2cd33811e4accad0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116874, "uuid": "cd52f6d1-1a40-446e-b96c-160fa3ad5eed", "comment": "Malware payload", "value": "bad7113b450ad6f35dd51b8a2e3787be4795518a44e9badb3273e346d67a79a028e0681ac1bf128acc8c9c0b51b5589b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116874, "uuid": "535cc0bb-4fdb-4ace-b1c1-41118a4789cc", "value": "T134A112BAF684C5B0C61FE6398248BC1C0520BAC3C2D02DC467BC6C2A9C95FCF6D656C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116874, "uuid": "db2b53ae-52c5-4857-bf4e-903314a4b203", "value": "48:CBn6zALDCn/r4vGXKQuT4vGX1ebB7xxg8PzUPeSy3n5ZWibrE7xxpsGyN5nVJA7J:CB6zVnUujruYlxbnExLAexr1nPnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652116874, "uuid": "adc4a898-33af-48a7-accc-ccd8355734e6", "value": 5010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652116874, "uuid": "bd057908-48ca-46e7-8d4d-e7db9d717051", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116874, "uuid": "c15770da-b766-4d70-8f75-659ef6f76d2c", "value": "attack.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a60b2ea-cfcf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652124894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124894, "uuid": "09eaccc7-8c08-4576-9336-d441a72b31ff", "comment": "Malware payload (Formbook)", "value": "4fc8947cc4de2a9c5f09c5c78155881b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124894, "uuid": "93789654-c1ee-4264-a7b0-1eb101b2fad3", "comment": "Malware payload (Formbook)", "value": "95c30ee77cf4d9e39a29a1dff147a9154b0dd7a6499b9deae1537d3ecabf4774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124894, "uuid": "73575ddb-b936-41f0-9b1a-3a074da1876b", "comment": "Malware payload (Formbook)", "value": "cc92312afbbe2057cf663036993462261e468301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652124894, "uuid": "f1927926-627f-40b5-84fc-acc52b45af0f", "comment": "Malware payload (Formbook)", "value": "ea23fc8d38916b04356b2b674a100b46576b3b81c602339f52fdd2302567f9acaa22edf02d57bddf107db935d0833584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124894, "uuid": "a667741e-04e7-4fa4-a9a4-400f8e36715c", "value": "T1E1945BD0E291F8D9D42944364A79D531160BAB3DF4B8493F28AE751A74BB38360BBD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124894, "uuid": "d06dbd43-317c-4a2f-aa03-a91960f57ec7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124894, "uuid": "780de910-c6d4-469f-9243-84c9f6b0b372", "value": "6144:eNeZ1ak7X1jZZZkmI3y3/GQ8gTOK9u5I6pvdCnSEYc3JtBbycfv4uLq1IfDI3T:eNOnIq/GQX6K97ICSxC80v4G2IfDI3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652124894, "uuid": "1614bca6-7504-4191-87d8-3caca3074b7a", "value": 433952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652124894, "uuid": "cf0a122b-20d2-49f8-aa52-571ec129e9f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652124894, "uuid": "0033f9b8-ce26-4d42-b200-fcceb52a0f7e", "value": "obi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfec7dc5-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652110623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110623, "uuid": "de969070-931c-4f57-a1ee-da5819b73cdc", "comment": "Malware payload (Formbook)", "value": "eb726c6966272d0c7abb982b176be72f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110623, "uuid": "39f1e16a-d535-40ba-8da9-f6e2b2cfbe43", "comment": "Malware payload (Formbook)", "value": "979e6010742733141e395aff43999e6665a5f797d8ccb24bfc3b779c1d46fdc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110623, "uuid": "c356669c-dc38-4853-b774-58a62c817021", "comment": "Malware payload (Formbook)", "value": "bc05ed6990863096fb5465607813d461558cb34f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110623, "uuid": "cebcd946-86f3-41cc-996a-dea0f4a2b602", "comment": "Malware payload (Formbook)", "value": "ea61bc1e5c8fe51f856c02a1787fd970eef1e86e35039363a4f0b318b54b16ad8fea4ca368608134fcd81491e8712c0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110623, "uuid": "b5641ae7-3df8-4d00-a142-4e2faca78cbf", "value": "T1A2E48C473BCC55D6D1AD2A30AE58F32CC2B05DCB56698E0B5C42F1D92B3128526F36BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110623, "uuid": "2089b39f-4873-4182-a1ef-b23cba8208dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110623, "uuid": "7703f291-ed23-4bbb-be0a-a8bab25a71f4", "value": "12288:xfjz4ZagOG7MRA2AgCasL1oknSSDw5V+xh:tjz4wgOG72AgCan8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110623, "uuid": "4d9b0e53-ac38-47d2-bfd8-2975865f8fe1", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110623, "uuid": "96f696ac-c083-4abc-9863-493b830985ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110623, "uuid": "0cd8d69f-11d7-4314-982e-50769a54fc60", "value": "eb726c6966272d0c7abb982b176be72f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed65192-cf46-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652066276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066276, "uuid": "71994581-7485-457b-bd5c-d399f8c3d1f9", "comment": "Malware payload (AgentTesla)", "value": "1bbbea7e7b7a9d660628b7cac3e131d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066276, "uuid": "cc28263c-507e-4e07-b316-1a09cffe57ba", "comment": "Malware payload (AgentTesla)", "value": "98e851cceece53c60eea3f983daa98881d60125370f1c64640cfb326ba2a211e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066276, "uuid": "b71a9834-0d2e-405e-9cef-ce579d5a59d0", "comment": "Malware payload (AgentTesla)", "value": "9115d4b4eb2afef968e3744bad44619671d7566f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652066276, "uuid": "bdb45c88-dcbe-4435-bd12-0fa4dc2fc8bd", "comment": "Malware payload (AgentTesla)", "value": "b61eb32a56e352744ee7e46dd2b1d85502cae1ad595f098fc3efc8c3d310260319825aaadbe6f9c36a99dcfb0b6de70e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066276, "uuid": "d2c8bb68-f4d4-4b3c-b927-e09732b9ca76", "value": "T108C4599CB12035DEF85BD471C9686C64A691666B431F42039433E3A9AE6DAF3CF44CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066276, "uuid": "6dbbd9cd-cbfe-4c20-b932-3d9c5819df2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066276, "uuid": "0d14b4f3-e635-4395-af39-27301a5aa335", "value": "12288:7gjjhNGf839z3Fb5rUYYM8zsuf54UaeI82kmpCHAL6XZwmz0kVLu6m:7gjjhNm8hhVYMAsuf54UaeI82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652066276, "uuid": "7bc7b3c2-2722-4d70-a4ef-82255ba0a660", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652066276, "uuid": "1e341463-6c56-4f3c-80c1-0dfce186fb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652066276, "uuid": "b4ab4f53-2bb8-4d25-8c50-06617f167855", "value": "Shipment Advise & BL draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfa1fb7-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652130992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130992, "uuid": "141bc8e7-2b5a-4774-ad7e-a163868ee876", "comment": "Malware payload", "value": "d401aa0418947f34c79fcc47c46bd0f6", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130992, "uuid": "8bbe623c-ee09-4afa-ac30-4ec99cbb3c35", "comment": "Malware payload", "value": "99f851f6f424fc2d9e7f068d5509bfd9134b881e10d76a41f057017e47bd0901", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130992, "uuid": "1cc5274f-e8ab-4dab-8034-13f9667505dc", "comment": "Malware payload", "value": "ed59a58bc54e1f0f2f6451cdaaf60384ab56e431", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130992, "uuid": "411f211c-dcfe-42f9-8dff-85f54a980ebc", "comment": "Malware payload", "value": "576d552afe6c4d6a1f5aab466e087ad62cae1405b82bd29d11383fb85857e080c0e2b44fb1754ec4beec935576551e1d", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130992, "uuid": "7e5d70da-ce68-43de-b893-2e80a8fb67e0", "value": "T1D3F42312C0CB934FEE9B456517B25366C7C487149AECFA397A910FEAA98031BF4CC14B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130992, "uuid": "6d9a7116-d597-4cfb-a701-b076c2ef5650", "value": "12288:WuZiUpBw6LlZDmrEjVDulmjANzeg2BpgrRKeuOLipYG6crVw1b+/+vAgfB:7iUs6LjBJ4mUNzl2BpgrRKeu2i7PLY9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130992, "uuid": "e5cd98c3-b561-443f-950d-561fe2964140", "value": 724867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130992, "uuid": "b9d5baa7-add0-4b84-92c8-a2e9b3897032", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130992, "uuid": "40ca2c18-2839-4a52-a65e-c7633a29a1c7", "value": "invoice_pdf_32.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767102e6-cfb9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652115600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115600, "uuid": "0ec8304c-96df-4732-85c5-49431367402d", "comment": "Malware payload", "value": "bdb8f624c273c6465c4a77d9286cadc6", "object_relation": "md5", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115600, "uuid": "19cca737-cfd4-44bb-b4a9-39a818d7b34f", "comment": "Malware payload", "value": "9a6803a3a18beabace30fafc51b16aec40c86d32274d206cbd5f171da8e3881f", "object_relation": "sha256", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115600, "uuid": "0f580cf6-09b2-4e78-bc3b-516077558189", "comment": "Malware payload", "value": "9a06bfddb2fb709704b3eaecff3b2f87fdcafb7c", "object_relation": "sha1", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115600, "uuid": "f9039fe3-aec5-4831-9d7d-d60ce9d74eaa", "comment": "Malware payload", "value": "a12dd166fc154752558beed33b9f0f246164f62fbc7f2803ee86c70a12bfce58e9f62bcf95796094e807e7b87baef76f", "object_relation": "sha3-384", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115600, "uuid": "b5800816-f36d-4322-b7fa-6f85d5cac3e1", "value": "T1ECD56CF89F99244CD837D8399497BD7A9B8835135B4EAFD03717E9126276308A82C1CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115600, "uuid": "f63b653f-3943-4cf4-8750-d40dd277bc40", "value": "24576:+aBf87gheqqqguvaURKZX7FvqJ3eWrcQmS0FMnRWN3FctRdTaEg7v7mIPb9XJzbZ:6YaeOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652115600, "uuid": "e0302923-c28e-42fa-8c98-5526400e9eaa", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652115600, "uuid": "095e0a82-c7df-4638-be08-f338298d36f9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115600, "uuid": "5891b9e2-8d56-4759-ae87-754059139b7f", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2564854-cf9d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652103782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103782, "uuid": "66ae039b-5486-4515-8f64-a33124171834", "comment": "Malware payload (Loki)", "value": "ae002d3c34a2d30817791f665520d343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103782, "uuid": "502c6876-b422-44aa-9fa6-011f5ca98075", "comment": "Malware payload (Loki)", "value": "9be5cbe41038f9b8ea7c5df80083f54642563c48f1f218bfba2e8acc6f566724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103782, "uuid": "82afb249-68a0-47e8-938c-2e3d86ebecd3", "comment": "Malware payload (Loki)", "value": "909988e5664ded6ff9e5150a46592cf62dc3a814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652103782, "uuid": "59abf3b5-e508-4793-83fc-92dc5059d478", "comment": "Malware payload (Loki)", "value": "b9246b9d856519667a82d8683e339d4255e494931c7186de0e45aefb78e6a6fe2f678002125ceb8ee66e4e9013659388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103782, "uuid": "8a81e636-a647-410b-a152-9fc524cec63a", "value": "T1CCD34A45734BC5A1D685923EE7EFC2F91373DD128642CAAB6761BF2B7A32307C908240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103782, "uuid": "74a3e39a-9fa4-4f4a-800b-5d6f04fc9b85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103782, "uuid": "69c6ceb7-4b14-48b5-aee7-734d9feeecda", "value": "768:fIYTZ9nXu3OVT3VFfT5Ydf9QuDdwzXik7RNi3CVP:QYTZ5XuQT3VFOUFDTlNp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652103782, "uuid": "fdf80482-086a-47dc-b809-b883f07ee261", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652103782, "uuid": "87e8759e-486e-46d5-b8af-a68ca6c7024e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652103782, "uuid": "d3716729-2f65-4554-9db0-3d2a45bd9f88", "value": "Omar5 Purchase Order list 09052022.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434e2d64-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652084590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084590, "uuid": "c1b95311-80cb-401d-8086-817a223d4873", "comment": "Malware payload (AgentTesla)", "value": "c6716ce1d38bb72eb2f20694ecf58b94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084590, "uuid": "797b90f6-7ef2-456f-be2c-bb9e3f9a51b9", "comment": "Malware payload (AgentTesla)", "value": "9caf679e0836ff2ae2eacb0b0600e22394cff2e43e21d637317832c0ce11f9d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084590, "uuid": "642bbf6b-2956-46bd-88ff-8aee98c59329", "comment": "Malware payload (AgentTesla)", "value": "b5d3df0cc324978227fdb173d469e33ccb67eef0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084590, "uuid": "f8cb822e-7c01-4fdf-9a06-94afb494c4c8", "comment": "Malware payload (AgentTesla)", "value": "339866277eae4ad7fac56e4bd8d79b8a16806c300a991f07514c3bec569477e50809cfdd701989e9eddf9571e5f11d0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084590, "uuid": "158e5a63-1de1-4f1f-98d6-5959aa1e3acf", "value": "T1E5C46A9CB12075DEF45BD4B2C9682C68A691776B430F42039433E3A99E6D6F7CE50CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084590, "uuid": "7c0ac634-fabf-48b1-b896-1ad9df6e10e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084590, "uuid": "1eca3d0a-9864-4efd-b20a-cad20d7849b5", "value": "12288:rgjjBKSHMIIYcxSKYPzC8e7T1hdje5Z+LdWZ7Um1391hyl+TdcI6m:rgjjB74YW1iCHrZeDOdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084590, "uuid": "3a06d694-dc40-4d0e-bf7f-e7b565c0c034", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084590, "uuid": "d7af145b-feaa-4294-81eb-0f6862b8fef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084590, "uuid": "692dfbe1-6157-44f7-a7a6-a85c06c476c4", "value": "HBL+MBL ADVICE DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a447d1-cf36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652059553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059553, "uuid": "050599e6-cbdd-45ee-8ab4-1bdc7bb27762", "comment": "Malware payload (Mirai)", "value": "359e65d9268bf43d07de939b6cb73563", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059553, "uuid": "1b0c5863-f8cd-4097-ba4f-223ef43ad7c9", "comment": "Malware payload (Mirai)", "value": "9cc89c892ff117b3b92f4a4f6f7b9d565fc31eb74bdce3150754660a9809bf33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059553, "uuid": "dc74bfa0-ef82-45b5-96d9-ac083aa83dc2", "comment": "Malware payload (Mirai)", "value": "67098a6ce134e59302df2b6f03e88854e8233130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652059553, "uuid": "51c76e44-0edf-4908-b87a-a4fe9cea7e40", "comment": "Malware payload (Mirai)", "value": "b881580bbfac5e6dde646c9fae28273fdcf9493ba52fe264dba441d80a4a66633ac8942bf98d5684ba7008c8cf1d0f29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652059553, "uuid": "5c3d09a4-f775-4f91-b0e0-9d499234c12f", "value": "T1F2335A31B97A2F17C0D4A5BE62F38324F3F5165E25A8CA2E7C620E4EFF14A4065476B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652059553, "uuid": "3c878386-50f4-4560-88e8-09cd44e17d03", "value": "768:ePoqqFPq9Qr0dn4Hte8KkblF7Co8ofvM0zO+yove2:eP1qFPSQr0dn4Hs8K07tHNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652059553, "uuid": "bf211bd7-fc88-4046-be3a-9eb38115dc29", "value": 52668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652059553, "uuid": "eb89190c-b97d-403d-893c-975eecc72ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652059553, "uuid": "e30e1c64-cbb9-4dfd-b9d0-84a53db3247d", "value": "359e65d9268bf43d07de939b6cb73563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1097bd-cf99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652101891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101891, "uuid": "6b851383-0236-45bb-bd08-d0dfbb2466e3", "comment": "Malware payload (RedLineStealer)", "value": "044377adbac248b45661667883c30d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101891, "uuid": "89e3610e-f3ea-4cc9-88e7-057b054b08d9", "comment": "Malware payload (RedLineStealer)", "value": "9dd73bd1cee56b4c222c2af4d2f83659d1aa1c0f7cddce38f716586e4777c289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101891, "uuid": "9c1422e1-a228-434a-923b-8b41066eb879", "comment": "Malware payload (RedLineStealer)", "value": "805b2d78ba3fdb48cbe79221f70089bb2dbc3e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652101891, "uuid": "30f19ddf-5e93-490b-b62a-cca4cecb5853", "comment": "Malware payload (RedLineStealer)", "value": "8393d527be555c107aa432698a499afeca7a7a61b02b044463f3996abcc3efd893901be116a5146cfeab3d50d3aae58a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101891, "uuid": "e2e716a9-2eae-452d-8fba-ca8195dc49e9", "value": "T17E449C12B6A0D432D1A34E309874F7E51A7BBC825B30598BF3A47B2F2E713E119B5356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101891, "uuid": "dc531cf7-7fee-4976-9e5c-0a69fc32d805", "value": "4b1f0b9cbec7348b33add629a60f3b85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101891, "uuid": "1939f5f2-f398-4f68-8762-179590b62745", "value": "3072:UZiUScupGLA9zAXlAg5Gzntk02ppihsxkgaBChX:kpSBpGLAlA2g5zq2iga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652101891, "uuid": "6b1fa77d-a914-4fbf-b1c0-4723f434a9ea", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652101891, "uuid": "cacc9fd0-98db-4d2b-81ae-00f117c90aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652101891, "uuid": "5fc57ec3-e8c8-4db8-a5e3-c9b61e68c668", "value": "044377adbac248b45661667883c30d1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec95a70-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652110406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110406, "uuid": "14b9596b-70d7-4ca7-b636-eae5681c8062", "comment": "Malware payload", "value": "133db6e3621379b9b2de486b814df3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110406, "uuid": "54359b81-2224-4fd9-bd15-2c5b5d150b4a", "comment": "Malware payload", "value": "9e29443e5abfbe431e368ffc7e06481fd964c3ba649586291ac47f15039ef7d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110406, "uuid": "d916c4c0-c18b-48b3-a348-5bd3d8387419", "comment": "Malware payload", "value": "67a27cf87cc360bf789fde385e7e91b5f6f436a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110406, "uuid": "95bd3239-8d0f-4256-9df6-19aa1a9cb7bf", "comment": "Malware payload", "value": "da497595595912c4dbd96893f15938367862d031e67cd54dfbe1ee270b8772a70287d34fde36b23456e5d86ccf5a21a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110406, "uuid": "66cb91f5-fd0e-4c77-bc26-ff8b3967e87d", "value": "T153D3020160A05726DB3F63F26926124047B8129A216BF74E5CCB91EE397EF415B60F3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110406, "uuid": "b6a54006-74ab-4f93-baab-31531f149157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110406, "uuid": "33a962d2-5e6e-4e0e-ac28-974ac0446b83", "value": "3072:9cIKHBTJNdwZ1nCPz5ZVjqaRzYBsrCxXTkDdbI/UcNibL253m:mn9JNuZ5CdXzkfO9I8eaa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110406, "uuid": "445baaa2-bf4c-4465-83b0-3c0fe920005c", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110406, "uuid": "c22bc0ff-d14a-4bd9-8522-c04df332c507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110406, "uuid": "308b2146-33aa-437a-b589-f2f60597ed33", "value": "Valkyria.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86a9662-cf31-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652057406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057406, "uuid": "97f2e731-e5c3-49ff-9e23-7bfae8142bc8", "comment": "Malware payload (Mirai)", "value": "b3437f59ab4a6d8da348d23a5f9d3ab6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057406, "uuid": "589bf108-0252-4ad6-b72f-7a13b70d9c10", "comment": "Malware payload (Mirai)", "value": "9e4f03ef6bca98ceabc968c2a7ada2a8cc81c93b3cbbb224536d3d304a0aff25", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057406, "uuid": "6e0ca182-a7ea-41aa-9248-8b05bade2deb", "comment": "Malware payload (Mirai)", "value": "42ba13ce31d84190e8449681f82e62e96031491b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652057406, "uuid": "41f3e866-5920-459b-8567-fb3619cd1822", "comment": "Malware payload (Mirai)", "value": "25ee60723262614c02dd5d7cd15451230df50acfb606b0ef254d9a11dce418297b2195cda86fd8920b5696ed3ecd1bd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057406, "uuid": "cbd39e46-29d3-48a1-af01-0132f0acb870", "value": "T183332A51BC919A12C5D4637BFA6E41CD332623A8D1DF33079D262F513BCA82F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057406, "uuid": "a7c2e8cc-690f-42ac-ab04-362f8adc4146", "value": "768:omso9sEallYUxBTcJ3qbxJ3USFlvG4UbPUWTSh05anSRZvYPvT/hcB3D8nRRePNj:2ooCUxdr04UdaqZIvT5r5xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652057406, "uuid": "dcb2ace7-8440-49c7-a7fe-a87f375be3d6", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652057406, "uuid": "399569c0-e34b-4f2c-8b1c-91a319de6f81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652057406, "uuid": "8cca3e65-b419-4a8b-b9c8-e23a3067db70", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa6a557-cf92-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652098669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098669, "uuid": "c0ddfcdf-168c-4182-bcc3-ab8a77c80b60", "comment": "Malware payload (AgentTesla)", "value": "7ea649e97e4c0f2d463b3371c3731968", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098669, "uuid": "290e4ad9-5904-48da-a1dd-089b26e0af08", "comment": "Malware payload (AgentTesla)", "value": "9ec5396bfca1b1b6d8c40f019c07e2af5881791400f63aaa674641452f316caa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098669, "uuid": "869a15b2-b44d-4f3f-9248-6791471e1852", "comment": "Malware payload (AgentTesla)", "value": "3e21316f99323ee90d48f8f4f9752e44859d8a5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098669, "uuid": "c03a8c8e-a647-4eb4-b138-71de506d3002", "comment": "Malware payload (AgentTesla)", "value": "82e2e6597a18b65992215bf414e791fbd3370ccf45360e7ec172ce5e9fd979c674fb78d46593f8772d57ff302266af0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098669, "uuid": "b0bb622f-e3e6-469d-8160-3ce593ca5a47", "value": "T10CC45A9CB22071DEF857D472C9682C68A691776B430F06039433E3AA9E6D5F3CE55CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098669, "uuid": "3a1938b8-a828-486e-9479-a792b44eefff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098669, "uuid": "017231c4-b703-45ad-ad4f-80d5fed218c8", "value": "12288:+gjjE3cz+A4TblelF2BEPXfXkyPNdMYjQxwIpOq/eTC6m:+gjjE3clAbYYWXfXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652098669, "uuid": "45359de2-5009-4837-a8e9-c81adde08b54", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652098669, "uuid": "324cae0f-9630-4bfb-a8ba-da2b7f1df152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098669, "uuid": "ae9cae8a-6502-4c74-8d77-d2ede73aec48", "value": "Shipment Advise & BL draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc0c7e4-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652107425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107425, "uuid": "318fe677-4cb7-4d61-b3b8-95ed82a16465", "comment": "Malware payload", "value": "0e120a5daf75489dbf55d292f762e8e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107425, "uuid": "b2d7d468-d5f4-4ab8-8854-ea5995e5d6a6", "comment": "Malware payload", "value": "9fcb723a9358459de0d60f7639767b77ff3f187c327b25b4006ff290d5a626a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107425, "uuid": "e32ec342-8fa9-4890-a446-26224b3404e3", "comment": "Malware payload", "value": "bca8e9818e94e7047d2be4b397495f230efaf5c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107425, "uuid": "259ccfc5-3667-492d-9632-12afaeca5eb9", "comment": "Malware payload", "value": "055e1c11222b94aaecf46d65a4506632401c054436f3ce400e737c35483893e7904795522170986d1127cb5f90480f24", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "shella", "colour": "#F0ABAE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107425, "uuid": "fa4a3fe1-1698-4635-99db-88e5d89c55f8", "value": "T140448E007880C436E8FF15324ABDCA6D5A3CB9610765D8EBA3D85D6F4F326D1BA30979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107425, "uuid": "5f83633f-e7d0-44e0-9a05-e59089113673", "value": "27400365a4f7805bfcb1363381b88c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107425, "uuid": "c55f1484-e85b-490a-895f-22a22a3e179b", "value": "3072:a8CgpcxLqU9g3TXFW09G1pBcouY6VqUZJYmhBE4ksJeR1S+m0zARJt4/F+lI3uAp:7YE/oncZVfcmh3ei+dzmFAOl9IZW3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107425, "uuid": "5d4710f0-3417-430d-8759-d38fd7617a36", "value": 257168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107425, "uuid": "5a62efa2-c070-4130-b549-440642f5eb09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107425, "uuid": "abf3d1c9-8d46-4deb-acc8-767a84320cc7", "value": "artists.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff56fd6-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652058627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058627, "uuid": "e73f0d85-bab8-47bb-a1be-fcd99f49d2f1", "comment": "Malware payload (Mirai)", "value": "c990d30360fd3e41858c55b89a3f7a5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058627, "uuid": "29e26ec3-e3ff-4ff2-a61e-398b6f8fa362", "comment": "Malware payload (Mirai)", "value": "a2418c7a868c57a8cfd1b070e19347877b56b4c572b5565c8334605d454f1a6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058627, "uuid": "a144ddce-7c06-4d50-9854-e478f8022856", "comment": "Malware payload (Mirai)", "value": "2ef58ab67e6dad91d0a41304cfbf3d93ff861e79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058627, "uuid": "667a8f80-eda6-4cda-8e5b-e360a339231a", "comment": "Malware payload (Mirai)", "value": "3e3921a50a91e3d86e3c242f2db28c9b1306618003380b6fb41fc934d9171b33222e94e1e2f70d8b385a0a54a26f68ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058627, "uuid": "51dec92f-2c81-4f54-b8e3-372e34c28ea2", "value": "T11A137DA6C46AAFD4C11446B4F8358F785B93F4008B676FF65A8985A28053EFCF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058627, "uuid": "e61299f9-3988-42ef-b663-f592cc5dcd53", "value": "768:Aaf+ywtYjrNqGFZFeVNOa3gri3HJJ/qdCboL4ZCC:AaWywtwDIEri3Hr/qdf0ZCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058627, "uuid": "b244e7e9-120e-4b33-a053-aa15bc6837ac", "value": 44736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058627, "uuid": "cc6fb384-be7c-43c3-8c7d-3d8baff622b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058627, "uuid": "cb514fcd-5788-4089-8f01-74415c62c27a", "value": "c990d30360fd3e41858c55b89a3f7a5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750048f6-cfd3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652126764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126764, "uuid": "6653014b-6e56-4c83-8c1e-4756cd2d61b3", "comment": "Malware payload", "value": "80f8291c0b707e1bf4c8d2fcb06e2101", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126764, "uuid": "6ff25c71-5688-4e09-a33c-43431c873eb6", "comment": "Malware payload", "value": "a2d4d2ff5706bf91fc7bde6d47390eb601d66e6e9776971f8d684665763467c2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126764, "uuid": "e1dd5056-d31c-4745-b460-08f7d8e15bb1", "comment": "Malware payload", "value": "539340af5194f2ab96dadb141e0727b70d000f0b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126764, "uuid": "6e973f8f-aa93-4f1d-befd-ce2d7b227804", "comment": "Malware payload", "value": "c3707386f53da50d04189e2df402c87789b40b401a38eb60cb21f87cb91303c55656788cae8a6551b2ac15028a4ebce7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126764, "uuid": "f36f38f4-db6c-4e36-8eff-b1b75d82bcba", "value": "T1AD11D54927C8662BC277463BC5E79313DB13B449DAC09DBF01E6416EECA12019F1657D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126764, "uuid": "3d93e140-a919-45c3-b6d1-d1ffe4870ff6", "value": "24:8DGnpG1QtSwKFAs5a99bBD4QBKxhQHSoojhji:8DKugdF4iXy5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126764, "uuid": "9ce4d97f-c433-4ced-b0e7-17a2552b4270", "value": 960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126764, "uuid": "8a9aa75c-6dc8-42ce-8cf6-b26668d889bd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126764, "uuid": "3f3a4e84-720b-4229-9f31-1662c982294e", "value": "japmtmo53.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624f3c35-cfb3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652112989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112989, "uuid": "ff40810f-2e95-48a2-9b09-91a20b64ccc3", "comment": "Malware payload (Formbook)", "value": "450c17cadb220aee09757fb954029810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112989, "uuid": "b2651288-aeef-4f32-9cf8-3732819726bf", "comment": "Malware payload (Formbook)", "value": "a31b89fb27e28a5fd844ec71770d7a8cf97caa296f615deb746739df6e8e2a69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112989, "uuid": "d70aa2ae-5a07-40d5-9557-8a822b2da39a", "comment": "Malware payload (Formbook)", "value": "d24cf180e34007e04ce6fb4daa2b216044e896a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112989, "uuid": "fbbb2786-3c4f-4730-88a7-8a84bed673a8", "comment": "Malware payload (Formbook)", "value": "087cfa8db908a5faa8f0d3c37c9d08e809ab222871c5e36bb5b0e370094bc9788fc9750835b35cbe6845f1014bfe8afe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112989, "uuid": "c0c7ff06-6e2c-423a-9d13-5ab891593e08", "value": "T1524412101375C0ABD4B34B31A939469BA7F7E26261B0061A27306F99393A352CC7EF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112989, "uuid": "3f22fe69-f5f9-4e75-8ce4-376839feb1ac", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112989, "uuid": "24e676a6-4da4-4d65-8c61-fb290be1d44d", "value": "6144:HNeZmRzY+DcAH1vUWDzAeS736+qFnDftIWNRE/7vm4zLyYL+y:HNllY+cC15AeSz6RnRrQ7zLyYay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652112989, "uuid": "70d82a40-93e8-4c08-8e7b-143d222127e4", "value": 255071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652112989, "uuid": "f647763a-8489-4444-9521-53a8b13aeb9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112989, "uuid": "10238447-da88-486b-99fe-b7e89bbf8039", "value": "rockku7566455344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04fe4b0-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652107080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107080, "uuid": "4537a56d-51dd-4efc-8612-2724125a4c2d", "comment": "Malware payload (AveMariaRAT)", "value": "958b2413a34997f88ba23cd7bd3f93d8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107080, "uuid": "b85365f5-7252-44c5-a24d-f0f4eb84565b", "comment": "Malware payload (AveMariaRAT)", "value": "a3987d853eb144e67990c5144b873019249bc17c3a08c05f39adc9138a5d609e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107080, "uuid": "8dfa78b5-085a-482c-ab8e-a3cb92c694a1", "comment": "Malware payload (AveMariaRAT)", "value": "67f4457fc7b2cf2603218b28ca039c446863a169", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107080, "uuid": "c553e9c6-adc1-4693-ba25-144bd04e322a", "comment": "Malware payload (AveMariaRAT)", "value": "dd6509b28b96e08d22ffd1c2f854252be070653cf49595ed6e157e1b4af6e4ecc3c2237404b7a6e8962c18cbe48aaad6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107080, "uuid": "6d237e69-29c9-449f-900f-874fa14d5fbb", "value": "T1B684BEDC755076DFC857C472DEA91C68EB6064BB831F5153A02B16AEEA0C99BCF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107080, "uuid": "29e49d38-6484-481f-982c-e48c423c2f22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107080, "uuid": "55b95330-6650-4b43-84d1-f5db29bebbe0", "value": "12288:yaCpPo3PerCHuhZwcst36d1HpbU9adWKGFxGfUaSJE5:1Ci3WrjkJKdfEadKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107080, "uuid": "b45db82b-b5e3-4acf-9707-e9cffd590e9f", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107080, "uuid": "5993c017-4ba3-4108-8205-08cd22843df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107080, "uuid": "234003c5-8976-4ef3-b10f-3e94c0821fe1", "value": "958b2413a34997f88ba23cd7bd3f93d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6814c49a-cf7d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652089806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089806, "uuid": "5dab3f21-efa0-45c3-9efd-ad865e512671", "comment": "Malware payload", "value": "abb4a1192d0919da01aa87b53538fb7c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089806, "uuid": "5da83463-a06e-49b9-add1-2df592619d4d", "comment": "Malware payload", "value": "a4874ebfe480449a897f86c87a490fbc4c2276d5bad4ff92bc93e2e8ae8efc66", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089806, "uuid": "ef488955-b096-408c-8643-4400e260c719", "comment": "Malware payload", "value": "b998c6de3c3835774eea6519102ce1fc040e33a3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089806, "uuid": "d9daafa6-717b-43e4-9f9c-9a763895183e", "comment": "Malware payload", "value": "c3acf5baf09044c2c1c65995f982d112596c51fa68cedb89bd67b10cd08667593d32d21290a09fe2fe4df1c9d8278ec2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089806, "uuid": "4c7f28ce-d048-47b2-89ac-72bfd2d6e06d", "value": "T1F3A5F142FB86A82EECF7C73A4776466A61028D268743D7878964713D1DBFDC08E46EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089806, "uuid": "e99b0830-3f70-4c4d-8320-a54ae74c90ff", "value": "49152:2mGSPqOLqtmZvQ/UOy6B4Kc4fbYrkJxfyO7W3+A:29SdLqL/UOzboO7W3+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089806, "uuid": "4a976345-1c5e-4504-845f-61bed0338ca6", "value": 2217936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089806, "uuid": "88603ab5-6376-4e32-8264-d394819b986b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089806, "uuid": "4c83b4b2-14a2-4182-98c2-12ca1c2c779a", "value": "easy.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6608ec-cf85-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652093300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093300, "uuid": "79193320-2792-4551-ad30-b4fe1d4b3808", "comment": "Malware payload (AveMariaRAT)", "value": "19a4f98db690991c389555cd3eb66482", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093300, "uuid": "f8dc53bd-3adc-4dfb-9cb2-491f801a9bb0", "comment": "Malware payload (AveMariaRAT)", "value": "a4bb0983343f4000840e30982d22dea648618e499b5909eb641311fce48d06ee", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093300, "uuid": "90940e68-cf12-44a8-85c1-d3f2ea673b39", "comment": "Malware payload (AveMariaRAT)", "value": "20541dd223a6e4f4ac07833a14cdcdf519ab7a7a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093300, "uuid": "029ef8bc-f433-45ac-9e83-cef8dfcb0e00", "comment": "Malware payload (AveMariaRAT)", "value": "229b8d8536a90bfce5b28ee30ee7f52019811bf8856e883d060482039fe85ce1ecd5faa832487017b030a244c04bca96", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093300, "uuid": "b7111b52-b899-477e-bf1a-f8220cf92f84", "value": "T1ECC412066AEF5762E67A43F24221538447F33A2C71A2FB981CC532EE19B6F854640FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093300, "uuid": "bf979bdd-5638-43a2-aebb-056328df6211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093300, "uuid": "db6d64be-b36a-4233-9d66-30488fe2b82c", "value": "12288:tZpP2L2I5VIf5DQFyvlRxM7AFM0z8lixAmjc8k8w1/8CPJ:Dp2vGMGkcS04lyAmIh8wRnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652093300, "uuid": "72eeef78-2aa4-41b9-bb2c-14ec72cc72b8", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652093300, "uuid": "1d2880f0-bf6f-4a3f-8ebf-9fea7a581340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093300, "uuid": "8059308d-740e-4892-85d1-e00eefd43d58", "value": "SecuriteInfo.com.W32.AIDetectNet.01.13256.19296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea184945-cf51-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652071126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071126, "uuid": "be927962-fa14-4120-a7d0-467013a01223", "comment": "Malware payload (Formbook)", "value": "0a092f9c9139d8a007ba8dd320ef1a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071126, "uuid": "ab256768-c4b5-4e47-82d6-b7d70e3f4c66", "comment": "Malware payload (Formbook)", "value": "a60357cfefd3efea8f2c06746d1cafbd447047247bedfba3cb3b1815f1a6b15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071126, "uuid": "02fd3e05-d772-4c28-b30e-68e66e4b5752", "comment": "Malware payload (Formbook)", "value": "54eb1c8e31fb2f96ae237241c280b97e3d873661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652071126, "uuid": "cc98e9bc-9fe4-4b4e-beb6-30fe9f1ef497", "comment": "Malware payload (Formbook)", "value": "36cd8d392e8fade9248783eb8a8660be13a1fd7434516627c17ee7b7c5097ec1799b1f0919a98c2e1c65c5227c25056f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071126, "uuid": "cccbc24f-db59-4a36-ac2a-854b28019b40", "value": "T12BC4AE862F84BA20C27E6774E7ACB570C3F061CF567E935F4442B1E56B363856A813E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071126, "uuid": "a41deb41-234b-4cb2-b0f3-3b815baf3877", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071126, "uuid": "a2436116-02cc-4bb0-9717-e6b958d97b6c", "value": "6144:FusR7jRlHie6ZufgZXEG7YLRXfSqdciZYn1n6s7OB/Xm1q7F8in8goyUnxY:Fvjz4ZagOG7MRSq2iWl6wa+1q7F8DxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652071126, "uuid": "49697331-0bc9-4474-9194-7ad947493b56", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652071126, "uuid": "5068e64d-6d16-4476-a9c6-ade4c03ebe35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652071126, "uuid": "0e1f022d-9d8e-4e7e-826e-a6bbaf8d4f7f", "value": "SecuriteInfo.com.W32.AIDetectNet.01.8263.13481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75fc1dc-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652058586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058586, "uuid": "7f2815ad-db85-43c2-8556-7d9bfe20796c", "comment": "Malware payload (Mirai)", "value": "e3ca29bdf616ea293b21646d75a131e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058586, "uuid": "9314afe0-ecc8-46f6-b91f-026e77352810", "comment": "Malware payload (Mirai)", "value": "a63e6572229b038c92febb6ab5594385ab469735c45763900d125b6e9fac6f93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058586, "uuid": "b732e33a-7881-4cb7-a0dc-c5b03d2db56d", "comment": "Malware payload (Mirai)", "value": "060250076fedfcc561d5a873a551fb8c65ab9657", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058586, "uuid": "a5065bac-c473-44f0-9056-873871117bc8", "comment": "Malware payload (Mirai)", "value": "1e6bcb7626ef4fa8e5c7c6614b7bcf2a15ed1033b127882ab7553699b703c1396fa227fb5efda36d869dbf9c3a83540d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058586, "uuid": "03fd0007-9d96-4ef7-b1b3-66ee86a5b4ab", "value": "T1003319DAB400AD3CF94FEBBE8017490AB6213750509327276777FDD36C321A49E26E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058586, "uuid": "a4ce4c55-1e6c-47ba-b5d6-3b42beddbfe9", "value": "768:KIeh5iNsouV+//cHOGgKKhSBT5u1We7TpwELJTuoiSFu8XQ:xw5i+oD//cDgKdBT41pJwELJniSs8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058586, "uuid": "3716dfc3-cd82-49a5-a746-3332561df790", "value": 50268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058586, "uuid": "20fb2777-b94e-4602-940f-8fb105cd5e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058586, "uuid": "c7fa1cb4-7c4f-47da-8893-9ee65e7e4a77", "value": "e3ca29bdf616ea293b21646d75a131e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe22dac-cf8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652095960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095960, "uuid": "d24c8f9d-bf8e-4aa9-abbf-1e8ba639dc0c", "comment": "Malware payload (Mirai)", "value": "0f9faf784c3b19c563f90e3fcdd65eb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095960, "uuid": "8ae7b757-6eb6-4c7c-a7e9-cb2ce01dc38e", "comment": "Malware payload (Mirai)", "value": "a6b3c0f5463f1df71d84fadfe5f4e43988acd719acf487de22892c140cf22c86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095960, "uuid": "417925c9-c435-486a-8465-8fdb07f1d0e4", "comment": "Malware payload (Mirai)", "value": "4a58bea93542a96e7baeac0cac89430d1a99bd37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095960, "uuid": "f1c45498-dfb8-40d6-82f8-53014504878a", "comment": "Malware payload (Mirai)", "value": "e249a7db4770dd7d68eee80c06a0d8caf2f355a5f7c7db10d06b52403a663435ed39c019eb9fdb771eb7464a048d7067", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095960, "uuid": "4f05440c-ddfa-4fb8-a717-a25758a241c0", "value": "T160932986BC419A11C6C61677FE2F108E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095960, "uuid": "9d146a1f-d55d-4c76-b200-ef660fd67222", "value": "1536:XhnRcUWoXufJ4Au8YKzv/MJ5zVMcO2aUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuG6hMRn0awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095960, "uuid": "3b2beb1e-b363-4969-9403-8ce55666e256", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095960, "uuid": "8d7c522f-c5cd-4352-833c-ccecffbda897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095960, "uuid": "77be8086-c783-4dea-82d3-5dd650fbf245", "value": "0f9faf784c3b19c563f90e3fcdd65eb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5193d93-cf73-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652085613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085613, "uuid": "91bc5b2c-f9fd-4e89-8f00-b6044a8a9387", "comment": "Malware payload (Formbook)", "value": "4cc272de09cbccb14b4d2e0c174cfe4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085613, "uuid": "4198dbcf-7e86-4c25-96c8-8bfe73c20dbd", "comment": "Malware payload (Formbook)", "value": "a6c9f393ac5677eeccc1451ed5e1fd58c52771c06673781ce495eb956c7b867a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085613, "uuid": "8744d93e-6c32-40eb-99c2-d3080a93de85", "comment": "Malware payload (Formbook)", "value": "0c8188ddb9af2fa1adef66f3a89c5ed974c08a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085613, "uuid": "c3746043-27e9-47c4-b7bc-84cf5da7ecb3", "comment": "Malware payload (Formbook)", "value": "08b15dd4f6efe4026f0bfc7b0883d1a3219d7f85792b591ab46b2fb5733dc692320d7f6e9fd961d41155b761a078c5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085613, "uuid": "319b91d1-b93a-437b-b4ad-344d262e8177", "value": "T166D41219B2FA5737E73A17F17240826013F2391DB171EB5A1C8935DF60A2FA22546FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085613, "uuid": "e28223b1-2257-4078-92c7-3e6f4eb1e8d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085613, "uuid": "c3a3a8ab-9a12-4421-a071-e6888d08c363", "value": "12288:Ctt2L2IazLy64AIAHWLXEwDpEk0Ntu/xmb83Ggpd9WVNNMX8:Q24KL8HWDEeWpgZmb2pmQX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652085613, "uuid": "d6a2aed7-6f3e-4a53-82a5-d8a3391b786a", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652085613, "uuid": "a5ae6500-7de6-461a-ae73-2935e72831cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085613, "uuid": "2866924f-44f6-403f-a66c-c0cc17ffca76", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97605b4-cf9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104223, "uuid": "1eeff400-2bea-4537-9754-199cab9c5cd8", "comment": "Malware payload (SnakeKeylogger)", "value": "7d7abab30698bb70042860c1f4af9153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104223, "uuid": "b63490db-b8bb-4729-ad85-d11c974752ad", "comment": "Malware payload (SnakeKeylogger)", "value": "a703dffa93bf07e3f4c61f9c6bb2f3747caf24b6298d2b77260d9875ae1ba10b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104223, "uuid": "17355b3c-1b86-4bef-9345-6f316fab55ca", "comment": "Malware payload (SnakeKeylogger)", "value": "de4889cb1474620d957bf654050b411479b526cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104223, "uuid": "29bf5a29-9ac1-4946-a424-8b2eba85f176", "comment": "Malware payload (SnakeKeylogger)", "value": "fb15ccff50989ad1e84cbd38e0e6121bf988f0ecc73b3b62e5812ac52f43943d3793aec702181e7a27f9cea624a5bd5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104223, "uuid": "0d11456a-645a-42d6-830a-ae23462c39ff", "value": "T1D8C3F70D7BF88804E6FF8A7311B15215C7B6B852095ACD1D16C2F8692A7C680DE1BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104223, "uuid": "e2f7c8eb-9329-4383-8dab-897608aae1c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104223, "uuid": "caf6e783-166a-4837-bbd2-8d5c7104e7ca", "value": "1536:CFFOkzFNsyvAjv9/uIlTJ72OIv/uV2qb/Up4Ohy1mzpiOWBFBF0Kcl:CFFOkzDsl9/uIlT5Fb8KOwBFBFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104223, "uuid": "e87a03d1-d45b-4aa4-ad72-3ca4dcb20f2a", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104223, "uuid": "ea697f28-25f9-4558-a914-0d2b08ad940e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104223, "uuid": "f659edb3-4b33-4f14-b324-31390de38891", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a7743a-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652084804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084804, "uuid": "7cb26906-33d4-45ae-bbdb-c0fd5fec5bce", "comment": "Malware payload (Formbook)", "value": "616305478f3a5ddc4a40612cde4f7577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084804, "uuid": "f07fec73-5f61-4e35-8426-26c6df1e34c5", "comment": "Malware payload (Formbook)", "value": "a88a1ec7699128b0e1f344c880b17b839927b7580e3bf7ece152dff57d719dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084804, "uuid": "daedd640-c79e-4ae5-b6a3-d31be2591d84", "comment": "Malware payload (Formbook)", "value": "9f388687fa7b1a7442132b5c51c4dbe32ff02a9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084804, "uuid": "926c8235-406c-49f0-8c17-a6a836816916", "comment": "Malware payload (Formbook)", "value": "fd4fbfd109a1a5b00591dcb2314f5af8ef437908e680290f05fb224c17a85814e67339a2492c79d518af983912754831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084804, "uuid": "ddf78bc3-6615-4bc9-978d-76ec5163eeb4", "value": "T18444021453A58067F4A97F3014266DBA7BFABC3BEC54D20B772076187279B4E8AC9343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084804, "uuid": "fddec7cf-8a27-42dc-8367-71e22317ccad", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084804, "uuid": "ba15f001-af96-4317-9503-f400dc5e0f1a", "value": "3072:61NjcVVnLpPuJboaKTY4l9zAAkPKgd3TS/jTHu3x3OeyuWA6Q/GiQw7itbxEmiHB:aNeZwohzwAQ/9ejTHu35LyuW9LlRT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084804, "uuid": "a38c99a1-1214-41f9-9e47-6e02c09633ae", "value": 266315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084804, "uuid": "eef4ae02-dc8a-4f6f-bcdf-76cfb04eee1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084804, "uuid": "672f8945-6c40-4d93-9e85-fb3cc5d2704d", "value": "Swift Copy_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1836b8d-cfb7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652114921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114921, "uuid": "690fcdc2-8be3-4b75-a237-97bc593f7704", "comment": "Malware payload (Formbook)", "value": "944bf1bf0d288fd880767c5276463fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114921, "uuid": "cf8b1620-0a4a-4c68-9f32-5381bc1c1dfd", "comment": "Malware payload (Formbook)", "value": "a9cd05943046aaf795208126f3c30d8580e635411a6b4e736704cefad149b0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114921, "uuid": "a7be6643-b563-4fb5-8a53-c7247587028b", "comment": "Malware payload (Formbook)", "value": "6d4fbb540aa0d235db253fced4252046a4841faf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114921, "uuid": "1f288e0c-8409-4e23-90b1-0a16e87c4330", "comment": "Malware payload (Formbook)", "value": "bdfe89c4e9270e2bd280cbd920ff9780be7a73a782a96bf1d360ace43a6b3c7af93bdf57d00b73941cd4ad48578d6cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114921, "uuid": "bd0b040b-25ef-42fb-853e-e31a6c0dd7f5", "value": "T1EF74E045FE68DA6EC0924B378B32D17AF5565F2C1424124F9BF2BE0FBA31145C48A36E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114921, "uuid": "b355a602-dc94-4c89-b09d-c08f824a2403", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114921, "uuid": "d7a65677-26b3-468b-9561-b6050e64084e", "value": "6144:gNeZSPaKzcYxglBzIcm0wCjUcR3AKD53PJWLGxBpYyX0Jh:gNRPVtuVIdcjZAS3P8GBYS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652114921, "uuid": "8e5e612b-cbdc-4f3a-bd9f-ca933b160a5c", "value": 353279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652114921, "uuid": "348f35f8-728f-441d-880a-be025cb032e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114921, "uuid": "1c9d7450-93a6-498e-ae59-b1d91bf3c9ea", "value": "NEW_ORDE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3eaa6bc-cf8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652095973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095973, "uuid": "80de6784-f481-4d25-9c0c-f803870595ef", "comment": "Malware payload (Mirai)", "value": "dd19833e53d360ec74497e5c82d68ec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095973, "uuid": "41eb6352-679f-4344-be31-605d674ff487", "comment": "Malware payload (Mirai)", "value": "a9d78d6c5dca57adfd723e97fcc46463f32a2638c33934ee820e19dc9dd43fc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095973, "uuid": "e4008cff-2aea-4e0e-bf0e-af0a6c5b6683", "comment": "Malware payload (Mirai)", "value": "4817c4004b69fba3d454966a2e4a5f3bc225d12c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095973, "uuid": "f00ba81b-4aa1-4f13-9d31-e41fe2c4f141", "comment": "Malware payload (Mirai)", "value": "6dadc1c35be7154a7025fcac982243fe04bebcba69d1a4679db389d20df1f9a721f21489e6231fd2a17156f204f054d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095973, "uuid": "09e2b07f-12fb-42b8-a753-4347ba6c75a6", "value": "T1E353E781BC41A669C7D11777FD9F559E3700A3C9E1E932138C240BA07A8F94B0D5BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095973, "uuid": "8266c48f-55d7-408e-9b68-8cc8260e4df7", "value": "1536:GogI5uRJ7lshCKotdsVKQkdFy33eZtQqQot3:GogI5uRJCQsq7y3w33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095973, "uuid": "cb5f3a01-a3c3-4d17-bb5d-21f924d6b51d", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095973, "uuid": "d66c24a8-3b20-4937-b3c0-b0e242b440a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095973, "uuid": "ac1c31f9-ee25-4bbd-a12f-716f803ea7e3", "value": "dd19833e53d360ec74497e5c82d68ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf8ee70-cf60-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652077198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077198, "uuid": "a8029e26-d189-49e7-91d3-6597d6e23bd0", "comment": "Malware payload (Formbook)", "value": "08b52091342db01d60c4fc8c98b7a21f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077198, "uuid": "fb37bc91-aa55-44c3-9cdf-ca191f835418", "comment": "Malware payload (Formbook)", "value": "aa33851b53deb01bac6a5bc9dd7db3985edde8c2e9a63a4463bc441f833fd12b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077198, "uuid": "92f4c44e-ee1b-4236-bb5e-ebc2a4e81d80", "comment": "Malware payload (Formbook)", "value": "724656a384e64360ee932eacc2608b4758cad380", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077198, "uuid": "b8525323-a8fb-4bb2-a868-342f9a400bb9", "comment": "Malware payload (Formbook)", "value": "2ac7043b6153eb946b38ab10201eb2eff72fcd5614a48c5c648e4bd1f5d447983502c2b1296cb54325854cd97652e762", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077198, "uuid": "94d5320e-6be5-4edd-857f-67356c514470", "value": "T104241269F032C8D4EB5F98B149D3BA3B2876FC15F811D47E635872BDCB31DA16400A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077198, "uuid": "645b0580-9e88-4699-abe4-2b55721548ad", "value": "3072:KhvmxdPzTg9AOly7QwupvUYPRiyP5tx8OuH3rFDhU3P6QB:HHXOkEAYPRiyLxz6K3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077198, "uuid": "f1abfb24-4f44-44aa-bb79-02f947118c0f", "value": 211400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077198, "uuid": "5e41cd0c-baf9-4a87-85ea-207b6cd2aed6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077198, "uuid": "a3aa1971-87a9-48cf-82d7-ab3f00db23ce", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c83cf49-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652107262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107262, "uuid": "ff71677e-bca0-427e-8f6b-56eeabbc04cf", "comment": "Malware payload (Mirai)", "value": "1d0e35008f9952dc7bfe7dbfe0fd2de0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107262, "uuid": "b12943e0-4476-46a8-a812-7962c5dfc107", "comment": "Malware payload (Mirai)", "value": "aae66e7db86f137bb333ae9d1202f0bd68f83c805237996ec1b6b4b409a52737", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107262, "uuid": "10c5a4a5-dc0a-48a4-8242-b5e44b5dad47", "comment": "Malware payload (Mirai)", "value": "ae8feb4a3493c5cec0199b856cd8c6bca47d0214", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107262, "uuid": "418b3cfa-631c-4e39-9d85-db40b60f59dd", "comment": "Malware payload (Mirai)", "value": "a1b082e7f2893da9a44773f7ac99a60c955a46bb093b87f73f6f6a583a9fe1729909c8c8abafed8e5d035b52dad50d79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107262, "uuid": "ea531a27-5691-4391-bb33-8ddf0a893553", "value": "T151D2E150F12A9D91DF318F72972505A22C4E6F7CA9DCE6A3116EC4CC5EEC00AEAF1183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107262, "uuid": "6d12d817-0270-43fe-b19c-5853640d27c4", "value": "768:5h9XbjWz0wCHTk3wvC13iZLsGb1BQ547/wmCcx9q3UELwh:5bucHggdxbDq4rfkLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107262, "uuid": "bab50d5d-fce1-4770-b036-8e4e167cc2de", "value": 29468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107262, "uuid": "d4589a7d-1c3d-43ad-9042-4e119ea52feb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107262, "uuid": "3c842ee3-2b16-495e-9b88-a4afa45308d7", "value": "1d0e35008f9952dc7bfe7dbfe0fd2de0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec88c44-cfbd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117466, "uuid": "f9a80b64-5a0b-4411-b44e-7a40ee94645c", "comment": "Malware payload", "value": "dd504bb8f7685a3451d5993c574e1243", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117466, "uuid": "592c8579-f617-4699-8a35-e735998d18fb", "comment": "Malware payload", "value": "ab5218bb169297b62946f813a5dd8449a828f9093649206b9b8339923a8918ad", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117466, "uuid": "ffb12a4a-1de5-4320-b3a6-82c83f556d7f", "comment": "Malware payload", "value": "011d2051cc7e60b2e2a26626fe4f8b2488dd2905", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117466, "uuid": "57784378-7f81-4b1f-bf8d-ecc28dd829e4", "comment": "Malware payload", "value": "1e4f5305f3589cb0cd1ea41eab2cfc5ea2e68310f612e1a7b765f9adb6f9ad887aaf04d59372fc9db25acaf69bc4a7aa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117466, "uuid": "26b33627-b0d3-4a1b-b3be-591c86d39f46", "value": "T1CA4133EE3017A8265A1B44F2EC0F186E6DB66107C1789480BB08EFD45E3861CE377A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117466, "uuid": "151c7f6d-f287-493e-89f4-efa3bff61c1f", "value": "48:NjoeeG0yt3sqrnsQl9L5io5L1F4hJ3LB03ehNij:6Xdyfrn1kCehJ3Hjij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117466, "uuid": "3a114806-af60-4aa8-b4af-594154351baa", "value": 2190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117466, "uuid": "4893d638-a406-4064-b312-857834507f4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117466, "uuid": "1e7d45c7-42a2-4893-87ff-e073f4c5894e", "value": "Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87c6663-cfd3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652126851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126851, "uuid": "4a5fe9d5-73d2-41f5-ab48-586d0c0a0c29", "comment": "Malware payload", "value": "61eec0a0f4bc84bfcb16e86f60e96e6f", "object_relation": "md5", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126851, "uuid": "24de62d2-0f77-4445-953d-438d21ce971e", "comment": "Malware payload", "value": "ab7ffbac9230a375b22baf9e5aa0e76d4f368fd609deff6ec4d1cec6aa255e16", "object_relation": "sha256", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126851, "uuid": "964b9c71-3055-4f3c-b88d-cc3715596343", "comment": "Malware payload", "value": "e0983b5b4c158c78c1c55089627d744b6ac424d8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126851, "uuid": "721d163b-dd7e-4ce0-9051-26d4276eae64", "comment": "Malware payload", "value": "301f164c8399ae8af2406eabc31669df9d440bfa2eb636e6718419cf92be5b54270a4b702f22d1a0821675b7d514faac", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2022-1388", "colour": "#9B30BD", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126851, "uuid": "8d4c1a7d-a879-46e9-92de-b9e780d77a88", "value": "T11911949D9070DC756E10CCA688E1B758C1ADD09AC8B36788F95D3D2C3FA9009F2E0A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126851, "uuid": "4e31a300-3cb2-4b2d-bef9-34d74320d669", "value": "24:fHAZNUHrG+7Zx3bAtu7Zx3a7Zx3W7ZxLA/uK2/IUyK:/NrGMJAt8O6Z/fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126851, "uuid": "f888e676-0402-47d0-8ca7-4b093d41e204", "value": 990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126851, "uuid": "1f6f2c39-c5d7-4169-80d6-180749e70ab5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126851, "uuid": "0828ef4e-a947-4165-82ab-8832003bcf85", "value": "kthmimu.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408916bb-cf92-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652098759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098759, "uuid": "3d52832d-c259-4dc0-b104-ee299daf149c", "comment": "Malware payload (AgentTesla)", "value": "aa60e014a28190b162c0e562215e0fb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098759, "uuid": "53ea79c3-ed0a-4e57-a357-3e83b7bc60b9", "comment": "Malware payload (AgentTesla)", "value": "abda3d5a215e95f44148206514bfc4df6aec9ce0452fea7593ba53a81ae7d029", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098759, "uuid": "edb769bc-814e-4478-bc34-3de9a81678e5", "comment": "Malware payload (AgentTesla)", "value": "caeb12f67dff933b3df2172c23f63360c704bc4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652098759, "uuid": "40e3284b-a5d0-4190-8b2e-899f5cdcdbac", "comment": "Malware payload (AgentTesla)", "value": "01c2b2f312d83501981e0828107d485f26611d3115dd4c17ef462a40900d870a11d510f3cf646aa2900b7a016596a72e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098759, "uuid": "0c958ac4-45a5-41e8-a9a6-50eaf5e0094e", "value": "T141A22A626A1E8861D6D5863ECCD6C6600367F607947FEE7E30DE070A9F137B1DA22316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098759, "uuid": "17cc4586-c101-4124-8701-7d44713702bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098759, "uuid": "03140e51-3dab-4b5d-83fc-fad29c5ff624", "value": "384:AIltcqd/lTYOnPuhvNbp93lceUe3ysCApw6YZU3KD/KDaYH+X:vlm89TYWP2QemsNpM5YeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652098759, "uuid": "fcb58e87-89ba-4003-adbd-5b101880d045", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652098759, "uuid": "51d15638-8bb9-4921-ae10-9073a99c7b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652098759, "uuid": "700c9773-f874-48b9-a501-f936f60e5c63", "value": "Siparis_FIYAT TALEBI \u0130STE\u011e\u0130 BATI San D\u0131\u015f Tic. A.\u015e pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bca506-cfdf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652131926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131926, "uuid": "81dbc80f-df27-4490-8e0c-a6c68db0097d", "comment": "Malware payload (Mirai)", "value": "63a9402a6fa90a5e0f09ed89ac1a2069", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131926, "uuid": "7322f8ab-be8e-4530-b131-faf7147bb190", "comment": "Malware payload (Mirai)", "value": "abdb0a44b6ea61e6e2cfd1c78f1993a3cd3191728da4201096968577c535a422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131926, "uuid": "0f63084e-5f72-4179-af3d-b3c31c2f659c", "comment": "Malware payload (Mirai)", "value": "18c078fca9042e571ae32a21fb3f292f10f579dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652131926, "uuid": "ab84ca13-7f7f-42e8-a032-2fb49afc5d0f", "comment": "Malware payload (Mirai)", "value": "d52438ed6c9bb0610a2451ca724e0af6bac58bb64d5b7e68a42499510d2a26ef1c3bcba6c0845ec46ed9a858f57573e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131926, "uuid": "7613d3dd-f93d-41ba-9568-88a16b5a328a", "value": "T1CD734B24A9792E27C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF2465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131926, "uuid": "e3e8b8dc-2f48-4b46-badf-ac0b2e2798d8", "value": "1536:SbHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNTKjfdFRo:omcjaq+Dcc5J+vNwjfto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652131926, "uuid": "4889000b-498b-4850-b2a4-88526c29014b", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652131926, "uuid": "933f666d-5406-40b8-a724-6ed9ca451c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652131926, "uuid": "9fc81c01-0b88-42c7-8b7e-5c4f4aa20fbf", "value": "63a9402a6fa90a5e0f09ed89ac1a2069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9207546f-cf7b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652089017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089017, "uuid": "d2c93458-c90d-4c89-a286-a4324f803c3b", "comment": "Malware payload", "value": "696a2aa5504dd974e6610592e69ba789", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089017, "uuid": "0952d8ea-a337-40a2-9938-2ecc79029eae", "comment": "Malware payload", "value": "ac64adbfa128fd5f31bd922957942a1b80c56ee119791a29b939be04e1d7e2ba", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089017, "uuid": "5a3639ef-4a0b-430a-86c0-6865c1a6a853", "comment": "Malware payload", "value": "9d9e4c1fff54da830a54d6e915cfc083b147f87f", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089017, "uuid": "d2e434a2-5e8d-45f2-8291-935beb3c2425", "comment": "Malware payload", "value": "5ee001056dee66948f0dd4ed44c8532f5a1f9d9c8b43d6e609b970dcf1435f2981e7d5a76d0cd8a131de7a5e43c5f88d", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089017, "uuid": "54169031-db16-4ba2-8148-daa551b59424", "value": "T18675EB31B132BA87C3160561565FBE86531CBE43B2C55F8CA04DFBF82CE6CA69342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089017, "uuid": "82131826-92aa-4159-8564-25781ca84a67", "value": "1536:cch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bb:sp0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089017, "uuid": "3a068e10-02bc-428c-9094-9651ba0389a0", "value": 1677933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089017, "uuid": "78606cbf-b1b0-413e-a3d7-70ce25ee6d74", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089017, "uuid": "3988b591-b4dc-4268-b188-b9f9b31b8568", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.7134.22504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8192432-cf85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652093403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093403, "uuid": "e3d96dbc-11eb-4439-b0a7-fcbb6f79010e", "comment": "Malware payload (Mirai)", "value": "7502b55dd219a5ab0a9d6ba85054e663", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093403, "uuid": "c9139ffa-e25e-4515-bc01-9a825b332a29", "comment": "Malware payload (Mirai)", "value": "acd12879ec3bf601c8ef8a9df66af86016d416ce200b28c5c7efd0031d61f24d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093403, "uuid": "9638ca67-de95-4783-85f1-c7d605e63db4", "comment": "Malware payload (Mirai)", "value": "d618e6675b3f5091e037427710c9ebc448d12d95", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093403, "uuid": "97ad3386-7dfa-4f2b-94fa-9cc6f7381c60", "comment": "Malware payload (Mirai)", "value": "c8da1a7a8bbf08cd882b81e5041403eac75864b1e39faa775df603330606a5c39c651bb73ad34c9041d2a6261d9e09ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093403, "uuid": "4dd4d7e0-1c7c-4f3f-8d80-2336d3303ab9", "value": "T1CF735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093403, "uuid": "867c6983-3460-458a-91f8-24ebfbb3dcd9", "value": "1536:b/DYQYs1ZokODichnN15UzOHIt09KfsH18ruUGDKVQSi:zDhzUkODichnBUzk40Y0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652093403, "uuid": "c6bd2f5c-fcfe-4028-9715-f62392082213", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652093403, "uuid": "beec2706-3d27-414c-8153-6d4b2427c512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093403, "uuid": "b64ba081-dd62-4fed-867f-16be91bc656a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2282fe-cf69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652081411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081411, "uuid": "db2f7d26-40cd-4a24-9c8d-d0898371afd4", "comment": "Malware payload (Formbook)", "value": "49f764d43e7ca882a3587bd5b6d7fd32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081411, "uuid": "927e9356-a478-4d6c-b523-797d721e04f3", "comment": "Malware payload (Formbook)", "value": "adf0543a3db7281e8867f74725c88ad3d0b55529500206fd70aa570bb3656d84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081411, "uuid": "869f2ecf-a63f-4a34-b40a-7c81703cbd7d", "comment": "Malware payload (Formbook)", "value": "0e8be8254292a585a95ecc00221a7f10fff813b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081411, "uuid": "527429d6-ae79-4bd1-bb20-0984cb84cb9b", "comment": "Malware payload (Formbook)", "value": "8365a6ed82591704cf31a0f938ce7316fad2537521251a872f2aeafe6e7d9af786b92b6535ba32d9ee3bbb3c1d4cdf71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081411, "uuid": "88affae7-c6f4-4c07-94cd-aa318e33ed91", "value": "T1E2B412693A9DD2F3C72705BD6047B14722B0482B8562F685ACE924F5A7C23CE9B04FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081411, "uuid": "f65fc364-a86d-4aea-aec3-61402b3cd424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081411, "uuid": "a7fc1194-0799-4619-acfd-5c7ee8e1a7b8", "value": "12288:X2TLmna+qXVA/bci/+oN7MQ7iwf86EJlGKqN+8CDDVOulWfbyIJeZ5f0:bjbci2oN7M+vf8AKZvDROulGGUeZ5f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652081411, "uuid": "f524d183-3d9c-4a61-bd28-39fa63347ce6", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652081411, "uuid": "52675187-2050-4915-9365-84d922e982f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081411, "uuid": "1e0fd91d-3efd-4540-be03-b03ba4fb5aaa", "value": "SecuriteInfo.com.W32.AIDetectNet.01.6916.28515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6823bd-cfb9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652115499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115499, "uuid": "f43650ab-f588-4afd-b5a5-05ee231bbb17", "comment": "Malware payload (Formbook)", "value": "a3a3d40ac3c1dc25052405b4b47faa73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115499, "uuid": "6f9645f5-782a-4abd-a591-06699799c6a3", "comment": "Malware payload (Formbook)", "value": "ae780be61afe538f90e40159595af388df5a27131b650c229f9eaf5e362f21a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115499, "uuid": "9021c561-cea3-4456-b4be-c08336d728a7", "comment": "Malware payload (Formbook)", "value": "74f8d26eb877c7b5abb6050c33191525df10c1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652115499, "uuid": "36aec844-227d-4e34-9ef2-a324e931b8e3", "comment": "Malware payload (Formbook)", "value": "f092bafd1dd80183a1c5740f7c8e93ef2cb2ac43e0e7123298c3022f92e8cc2c2f03a4ff89f7a2d996d1a09bd7b75464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115499, "uuid": "b53a6d0b-86bc-4bf4-8528-79953723d204", "value": "T12F4412422BB8C0B7D0EB8B366D3A972677FC911711B09A0F1720DB967977381DD0A786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115499, "uuid": "6526cb60-593e-40c8-8c39-ccc343e75d25", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115499, "uuid": "f67a6cfc-81fe-4a2c-89df-b0c5dedf502e", "value": "6144:HNeZmycHcPWIY7paem/E3L9vyxItHyuvaMEgxABwIZ1TmOBZOLLq:HNlycHc+pFaQLWIkuCMEgxABwIXTRBwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652115499, "uuid": "22c950ed-f30a-464a-9a12-bdf26b3c46b9", "value": 255432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652115499, "uuid": "75958dfb-4b36-48f4-9d0d-18eccf0b3217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652115499, "uuid": "13c945b9-8235-4be2-9e37-cbfd52459356", "value": "Factura_834.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f9a9ec-cf5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652076188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076188, "uuid": "5391878e-53cd-4119-a08e-a5e69741374d", "comment": "Malware payload (Mirai)", "value": "55962eae3496a03718152b8e3bed793c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076188, "uuid": "bc1dc254-0f7d-4e97-93e9-c9ac1ba054ba", "comment": "Malware payload (Mirai)", "value": "af660da1b4ab9a33101556a49dfa18f23a0a88f4400d57c313d06306da70e082", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076188, "uuid": "1f20dbda-b3b2-409f-b3ac-1210c03106ba", "comment": "Malware payload (Mirai)", "value": "11372a7abe72e13c19b2b42606a8347c61e7c24f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076188, "uuid": "0ecb89e8-719d-47d8-8f9b-4f39b7e23bcb", "comment": "Malware payload (Mirai)", "value": "21abc2427148140674d04f1134d587818b1640b7c5bd195670a1f97daf9c96c5d5287b8b4112bf19a1484e20a9bb2bc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076188, "uuid": "ff82a608-50f7-43dc-8105-db86155230bd", "value": "T1AA634A01775C4E43D1A61EF8293F27E193EEEE9021F4F5842A0ED6465272E33994AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076188, "uuid": "c9012cbb-3109-468f-bb2c-74d700737830", "value": "1536:ZjVO2KsrO4zb5Bd7mBpTaQnQSe1ECj5ds:CPsTHd7kNQSe1bjrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076188, "uuid": "046f453d-e287-46f5-902b-d90ef71c9ac6", "value": 67576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076188, "uuid": "2ea67199-37c9-4636-a078-b4907159bd99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076188, "uuid": "64263522-82d0-428b-a88c-34cad368f3cc", "value": "55962eae3496a03718152b8e3bed793c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6aa85e8-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105024, "uuid": "2b5cb2bd-2a5f-4951-936a-aa65080fc7ee", "comment": "Malware payload (Formbook)", "value": "39d2f9f16e87110cef9f4a7b212bc71c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105024, "uuid": "4b8b333f-0829-4916-ae60-ccc66fbd6fb2", "comment": "Malware payload (Formbook)", "value": "b0cdc0ddd68371d1a9901e23c22f53f353cebc910249941e231fd7b46206b454", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105024, "uuid": "050faf5b-b0be-445b-8775-04f151f1b887", "comment": "Malware payload (Formbook)", "value": "1271b3da39bf31b124e4ecc6628e1a439d6f0301", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105024, "uuid": "03f7d6f7-4850-4e6f-8053-1ac00156ef8b", "comment": "Malware payload (Formbook)", "value": "ed5fe6b4bfd834fd748628a11b42bec03d32f54abcb7a29b14ed98c5992f1d7af5089e80eea75003d4a87b5f8696e554", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105024, "uuid": "fc7b7b2c-222a-4ae1-877d-bb462fcc85b5", "value": "T11124128B7519CB32C5B2F9388DCE9E1641E05D8A8C19CCCF2CAAB671157CD3E5160A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105024, "uuid": "53863dc0-cbe4-4ca9-a323-33e16723676e", "value": "6144:GeUMDIxsbhf4RELR3eosNjGrnsIbHnOl2AMR:GeBc4ReosN6rnsIbg2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105024, "uuid": "ad072e1f-e7ea-4917-b900-83b05c26d46a", "value": 213512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105024, "uuid": "ed01dc16-4509-4f73-a021-8d9852bcf062", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105024, "uuid": "0c68593e-eeba-4214-8033-f25a789b28e4", "value": "Factura n\u00ba 220111826N.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12cd207-cf49-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652067702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067702, "uuid": "6711dcc7-995e-4045-a704-9f9fc90f519d", "comment": "Malware payload (SnakeKeylogger)", "value": "743d8012e8892f75b2275c74eeeddb29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067702, "uuid": "2e52074c-0fd4-4bb9-b3cc-f855d0ee9462", "comment": "Malware payload (SnakeKeylogger)", "value": "b16bc49773e1653815010381ec864517966d8566eb1249b53c217758f89318e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067702, "uuid": "f33e5c42-5eda-4532-ab76-a97b431b4d08", "comment": "Malware payload (SnakeKeylogger)", "value": "9e5d1403a103c980517e6c4c60244f07daf8dc47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067702, "uuid": "96c83f32-c16e-4902-8807-bf5b03fd4deb", "comment": "Malware payload (SnakeKeylogger)", "value": "8513fff6f99f7f7bffb9cd4b996f439532e2599fca8daeec825c41be8fdee1a4b93116e10c66de132885ad6737902d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067702, "uuid": "c924d19f-6dcb-4055-abec-ee095a57a7f1", "value": "T1FFE4F111EA6C3994D84BD7764841C14051AAE78F7E2EF65E6EB33C8F2870BC25291E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067702, "uuid": "153ab17c-5cc5-4f50-9a99-17cbb81b1dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067702, "uuid": "3fd09784-e3c6-4d9b-8d6c-a789e1ec52a4", "value": "12288:J6Cgjj5GWW9FPxIqszsS30bD69VaRM3WFfBUBNAa:UCgjj5tW9FxszsEb8RMmVKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652067702, "uuid": "0ba5c661-fa0f-421c-8cf1-e77ea7b1471c", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652067702, "uuid": "a1680266-4d4a-448e-ba6f-945822ffd639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067702, "uuid": "eca55be2-4fc9-4aa2-bb85-eda86074ca5c", "value": "Ramona voy 2022003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3e60a9-cfc8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652122077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122077, "uuid": "24bd0b8b-69b1-4dc0-9bf9-d4547a6399d7", "comment": "Malware payload", "value": "2f521acd87c231bb54a679a68e6854d9", "object_relation": "md5", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122077, "uuid": "eb262c09-711e-4836-a812-5ac5ae262561", "comment": "Malware payload", "value": "b27e363d2365ea2cc02ce83fd92f62d0035b676b1a5b6d0a4ae91b07840fc4f9", "object_relation": "sha256", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122077, "uuid": "65443de2-d511-43c1-a653-bbcafcca821b", "comment": "Malware payload", "value": "584d59d8f351df5229af6102d9a33bbd93d03901", "object_relation": "sha1", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122077, "uuid": "48c91b47-dc94-4f06-b2fb-13d5d603ed18", "comment": "Malware payload", "value": "b19cda91f6fdfe153e747220327d25a35d08ed973afc2075b1e0ef5a3f06c5d07a00bd9bfb4e6eeed1a1865666fa8282", "object_relation": "sha3-384", "Tag": [ { "name": "AbereBot", "colour": "#7C6141", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122077, "uuid": "fcb19f2f-c8e3-4810-8cc4-2160dea33bc2", "value": "T121959D86F758A93FC8738033496A1236216ACD568B83D747796C731C29BB6D80F59FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122077, "uuid": "7b8e597b-966c-40c0-871a-f00101261417", "value": "49152:y2V1LlkSTE96unGnjLAuWddjhakg9XHfrdCqwa:HV1L9Mw0dNhWHfrdCq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652122077, "uuid": "ce5bed36-1dc1-457b-b1f1-a6e0ef16753c", "value": 2000028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652122077, "uuid": "1ce3811e-df7b-4e88-9018-68cae1a1247f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122077, "uuid": "61c7b6f0-9302-4eea-af48-ed3438754344", "value": "aberebot123.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c9dd11-cf5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652076817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076817, "uuid": "8bb066a9-36e6-4bda-85b2-da646749c1b6", "comment": "Malware payload (Formbook)", "value": "787e8a049f5d1491e3c6b1f401fe3aaa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076817, "uuid": "bf13b070-397f-417f-80a0-00ec75869cf2", "comment": "Malware payload (Formbook)", "value": "b2a222b2146dbfd67dcf75786faa5815ad07f3067a3e6cf9decb2c57601e4e8b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076817, "uuid": "e666105f-3bc2-4037-96a3-3719dd8eebf0", "comment": "Malware payload (Formbook)", "value": "75a43fcf38a11abfd53c2e6ce659a68cf0bc55b3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076817, "uuid": "ccbccf14-76e8-445e-8073-a80e5244a876", "comment": "Malware payload (Formbook)", "value": "c49bd9d69e9f6bd5ff5f80d91144e0b8efab46586869b84229dfaf01b4bc6eb2e3d09532893582a37d31076e5cfadc29", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076817, "uuid": "766408ca-6336-4d85-a95c-adf257d8188f", "value": "T18DD42359DCE8614124DAFA3D3D5ACF980075A23AF4716631835DE27BE8CB3880FE991D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076817, "uuid": "9cf57829-4668-4566-a89f-630a930077d9", "value": "12288:wx8vGx4DNpOISs/eeTTL2nTR2x6Vl6GUZC6v0KxNvuq5I:hvG6DNIyeeHL2nTR2g7m86v08Ruq5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076817, "uuid": "f2b53af3-8712-41e4-9790-9272d119d01b", "value": 597472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076817, "uuid": "b3680554-8424-4d99-be1f-67e526b7adf4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076817, "uuid": "bf875207-d1d5-4c8c-a3af-b6c63c636e97", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9d5d66-cf5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652076342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076342, "uuid": "e0b4ae60-b2d4-44f4-86ed-5c71e304fdda", "comment": "Malware payload (Formbook)", "value": "166be404f96f2f34a8301bc239d11671", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076342, "uuid": "d7e9eb32-b0ae-4b37-ad01-d1e0ec292a2f", "comment": "Malware payload (Formbook)", "value": "b2a7d932d0eb49e7e3db29a7eda4d621878beae3125c1416999bff9de28316e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076342, "uuid": "a4bc1c81-b167-46a6-8765-182636c0fc72", "comment": "Malware payload (Formbook)", "value": "0ed862e82212d57d3f34e016ca98944a4babdd6d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076342, "uuid": "16ab5140-bbe2-420e-9f17-f06c65bca1c9", "comment": "Malware payload (Formbook)", "value": "8837ee034c1561c645ff619085118bd180a715affd8b74f6ab786099fed5920df8ace37cad1bd8bf84e604d76b4826ed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076342, "uuid": "b0fbbd52-115a-4f4a-aeb0-dae98ebd8b2b", "value": "T14124122E753045DAD3CF3AF0783C1489622EED1AC1E7C75A155BF1138CB8593AC6A5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076342, "uuid": "5b561353-4c02-4857-936e-6882f6416828", "value": "3072:n1zlyfXWIEYPeSMsubbtwHqwz4gf7xqrNF8MUT3uLWuRt5mnLSv:5EmTYPeSOdwz4gT0rNFMuRCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076342, "uuid": "12614a19-ac75-4063-a3fb-7fb1c61cef46", "value": 211640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076342, "uuid": "def1fe05-b9b1-4170-abd1-5921e0b2334f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076342, "uuid": "231b3dfb-c2a3-4eb1-a968-7f7d734c0a8f", "value": "data.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00018838-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652105093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105093, "uuid": "543c197c-eb40-40ca-865a-1e95bdb7e902", "comment": "Malware payload (Loki)", "value": "d8e94d31d0c37a7c19d8447d51af821d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105093, "uuid": "1a1ae068-059d-4e88-9442-cf401da0add5", "comment": "Malware payload (Loki)", "value": "b3722cbe3ffe32c720971b384369539e0b22e7ae290182601e1e56565aac55bc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105093, "uuid": "efb7bb94-710f-4898-8389-257856691b3f", "comment": "Malware payload (Loki)", "value": "15b80bb3d65dece48d184fcbd5259d50cfdbd7a1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105093, "uuid": "434e6e3b-06cd-4eff-a6bb-d66b3b0d2ec4", "comment": "Malware payload (Loki)", "value": "349d0bef46324d53f4d74d67614dbb105a57ab5df9e71f9bf47a22abd8ce968fa9efc528e2d6ada565e38676d9d0ac54", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105093, "uuid": "f9d6f203-9e9f-491e-affa-9f895a512a17", "value": "T1B324126FBBA8C6BBF190D67A52C4B024711DFE20C794D48E121CBAD38575F063AB9934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105093, "uuid": "e28ccc4d-d657-4bbb-9083-39d74d9f5d0c", "value": "3072:bWu9PrIoblJee0pX7SjGZtuQ12yZ4BzngL/M0ENzHOug23FayIzC7iExmYk3Z:3DdlY/J8GZ7QQG0HWHOR23FayIO2ymh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105093, "uuid": "aa138434-c2fa-4cdb-8a4e-dd059b372757", "value": 211816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105093, "uuid": "77ba4aed-4ee6-44ca-91b3-adf73d8a2fd9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105093, "uuid": "d9ac77d9-8b5a-4329-97ca-7dd22a90c93d", "value": "PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf716238-cf8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652095966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095966, "uuid": "bd423d56-4da8-4549-b460-991e743541c6", "comment": "Malware payload (Mirai)", "value": "96018176f994406591b4498ef323aa2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095966, "uuid": "dd54c217-7ebe-4cd4-926f-4150276c9ec7", "comment": "Malware payload (Mirai)", "value": "b4360c482a740eeafa76a8f168ce7a1025884c0cf2d329b86ba4c69a47ca5017", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095966, "uuid": "e3ae7f2a-275a-446a-85e0-28925fcccd4d", "comment": "Malware payload (Mirai)", "value": "f718ed6d33c5770d965efafa7a944e9dba4549a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652095966, "uuid": "c3728c79-6f62-4c51-90f0-301e2ea0c030", "comment": "Malware payload (Mirai)", "value": "eabdfde33c6b68c61fc29d7f5c87b0b2e2722152544b333daed6ab2800fdb3d0c9af3cf8c1a9f7be1ca08bf6188c4735", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095966, "uuid": "c623db2d-b37d-4fba-bce5-0f4e6e34175e", "value": "T191B3C40ABF610FF7E8ABEC3745A92B05249D550B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095966, "uuid": "49cd860f-cb66-458a-b7e7-0b5ee83e6865", "value": "1536:g9DYWFx+xx+AaEPiQMR2jk2EkZ+BzYtjKoOvDBgplbngVZ14hvG:gqWFx+xUA05R2hEkZ+BGpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652095966, "uuid": "f8330279-b8b6-47a8-9b43-5028d8618683", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652095966, "uuid": "5f592446-bb13-4bf3-a4e8-0fcffc9100ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652095966, "uuid": "db09176d-0a14-458d-b801-581d3ede4701", "value": "96018176f994406591b4498ef323aa2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a85ced-cf84-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652092649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092649, "uuid": "fc8cf5a4-f8af-47e8-b66d-4a0f3a33cd05", "comment": "Malware payload", "value": "90f87dd52501755382c9ff0e88f55357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092649, "uuid": "3cef4900-637c-4769-8fba-2e926e7e668a", "comment": "Malware payload", "value": "b4a6e2d9ed85c970394d2f0f7b9970f892f78b94146b022857b2bd0a9b53a7c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092649, "uuid": "6b8344b2-e78c-477f-888f-65b0212deedc", "comment": "Malware payload", "value": "6117a247fc13b51a4bb68e59e6edd7dc48c21684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092649, "uuid": "4c44160f-f1ec-4670-afa7-2e010dce6ec6", "comment": "Malware payload", "value": "929cc7635eca7bd00e8ffe9e340be5eca1e69f0a7cf2f05e102b52a27cd62de86276b06cfa578b24ebc5332ccd01f0f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092649, "uuid": "20e9aa11-ef3d-4953-98a3-13b4b87c7b6e", "value": "T11DD1E902A7D44B32DFFE4B72685753908334E32298A79F2FB9D451672D127E40712BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092649, "uuid": "4b0a71de-f28d-474a-bf7b-2dee7c90e9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092649, "uuid": "a32a5f9d-6a4e-4ef9-a036-1c4f1ce3b5c5", "value": "96:+/KnrPSoZDzj3SaqMa1Ef64gVNVI90yFHUKsrFzNt:zrZ7Xqd1ECfVfI9ptUKi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652092649, "uuid": "ae8d57a1-a951-45df-9bc2-9354cb9891ab", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652092649, "uuid": "84b0cfe9-66e8-4ae1-85b2-58b261311107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092649, "uuid": "30292db3-b948-45c6-8d7f-b2af9afc100b", "value": "PO#121900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbbdf16-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652084799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084799, "uuid": "ae26a0c3-b2c6-40c5-8d54-cdd603d51ff4", "comment": "Malware payload (Formbook)", "value": "1050dcfb5a3f8ff606049a41c882bd36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084799, "uuid": "17bb4ab7-76c6-4677-bf13-b8d5a4f07781", "comment": "Malware payload (Formbook)", "value": "b4aa332e0b01fcc44224b62f8d7b306b862523b7a276e38efdaeea019ce6d7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084799, "uuid": "6c803fcf-9ead-48c6-ade7-6f83dcfba96c", "comment": "Malware payload (Formbook)", "value": "2dd01580b2b15935a4027c92fb2b563cc632b0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084799, "uuid": "c3d35a75-0fef-427f-93c3-d5a83b3ffab0", "comment": "Malware payload (Formbook)", "value": "466868e9a81f996a75b104d6260d70194ec7d3575bc64a7097fa7c471ed73e8596e41279b4a39778bc2e1582a3f0d01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084799, "uuid": "e3edf644-804a-42ce-99ec-5854bc8afbf0", "value": "T1F3D44998B11035DEFB5FC071CC686C14A7E5726E033A5132B4A3E7999F6D9F39A40CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084799, "uuid": "bd6fe516-3beb-47d0-8a77-8bf571bdf7da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084799, "uuid": "6820ce07-20ff-4dac-a9f1-e8c274198d2f", "value": "12288:7gjjDQbxi4y6QQ/xCXwH6gj4Tnxb5Ki7hgFhyCITD60/oa1Yg5LaFb7HQT8D6m:7gjjT6Qi0AH6Pn137oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084799, "uuid": "1bb9cd64-010f-46da-822f-50f703126ece", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084799, "uuid": "55484aec-4932-4da9-b6c7-abdefae86354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084799, "uuid": "c41288df-1877-47b3-a0a3-7f2d3d1f81b1", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b96c7e-cf5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652075325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075325, "uuid": "1012aaad-fa5f-4f85-a66d-da932c622230", "comment": "Malware payload (Mirai)", "value": "0835225b416211fa4dad32f8b45cc393", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075325, "uuid": "1b8a9b66-3e45-4560-830e-b7c3a1a168c6", "comment": "Malware payload (Mirai)", "value": "b4b4cfb5e38055ea4cd6257c3306aa90e18660ada5c0ca2364bbf4084f349c94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075325, "uuid": "f55423c6-aeb6-4640-b50a-997b91456a33", "comment": "Malware payload (Mirai)", "value": "4847012646b75d6889fa347cbc7ca2de9ab83293", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075325, "uuid": "bbdf400e-fb76-4560-8e93-99066184b79b", "comment": "Malware payload (Mirai)", "value": "c8cb2515fd82725ef894c24c383295a6d0f977fb5f6d30d41480532e239ca29b6ff3fa20c319f87d7586e18069442d81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075325, "uuid": "e3111d1f-e535-48f7-b555-4f9043798d85", "value": "T10D831946BC819F01D5C912B6FE2E118E33131768E3DEB2239D149B247BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075325, "uuid": "e0a7cc61-5012-4622-8a09-c832f019aeb6", "value": "1536:CxnTsKJgf2wC2ZTKbMT4lsk5ba8wkbyMRiOcYc8QRQv5SYG:rKGs2odsYaycYc8QRQvMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652075325, "uuid": "3956f73a-6a7e-46a4-90f3-a1473ce84868", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652075325, "uuid": "8607fca7-9394-4171-9a36-ccc6a17721ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075325, "uuid": "f783c682-1eaf-44b7-a7e8-f52523991bfa", "value": "0835225b416211fa4dad32f8b45cc393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c6c9a0-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652107276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107276, "uuid": "d6f74256-45ef-4204-917e-841669ccdcb6", "comment": "Malware payload (AgentTesla)", "value": "437195190f83b81097e2865a0987dd74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107276, "uuid": "edc9b774-23e1-4b15-98a1-78c5643e7449", "comment": "Malware payload (AgentTesla)", "value": "b501346dd16256c25db575491f282861f51ba9eb9091ed5049a21e18663a8764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107276, "uuid": "70e42f80-4d94-4217-a5ee-a8dbbe5fab7b", "comment": "Malware payload (AgentTesla)", "value": "e2bf4ea9ff2b54e5b4806948d782bb6cbb1b1d33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107276, "uuid": "aa4f17e5-3781-42f3-bf51-28674c2fcf6b", "comment": "Malware payload (AgentTesla)", "value": "6603d34061c3c420385c8c88d56fa5683ba5ee8d231671ffbe350f28361ea940f91b4c846a83e08c975a49ccb09c7163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107276, "uuid": "3ed7cc14-0987-4617-923e-847b96b5539d", "value": "T1D005D0AC75507AEFC917C6BADA982CA4A75130BB531B9203902315ED9E4DADBCF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107276, "uuid": "9a51d0e6-4d83-4496-8a60-9817e9a86d1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107276, "uuid": "f1219f52-08df-4897-b4a1-f15b22a27a0d", "value": "12288:iP2L2IFeIR4Kfa3VhbPuUXbmTPah0RbMyQiRViiaLhJQXXkhOzMGkHwQl4BHNLzx:e2FIVhbGthbbQiYhQUMoGpQl8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107276, "uuid": "16e09e96-b3f6-4103-908b-4cea60ff8aa0", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107276, "uuid": "3ac91dc6-aa9f-4ea8-8779-7e12467c3740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107276, "uuid": "35b92a9b-ab89-4ff9-a738-0b9a645d61c7", "value": "437195190f83b81097e2865a0987dd74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68669ae1-cf89-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652094961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094961, "uuid": "d34e7803-3348-4ff6-af51-96eabc2b61bc", "comment": "Malware payload (AgentTesla)", "value": "20c98f09cf958e4410ffcb615a98e764", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094961, "uuid": "cbaef510-b185-453c-be0c-2dac267b5c12", "comment": "Malware payload (AgentTesla)", "value": "b5caf6284b19026e784cfe9fd6b047671b69932d59a095086a8a026112e0276f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094961, "uuid": "bc65d6e5-d1f2-4dc8-8d80-a9d108f96caa", "comment": "Malware payload (AgentTesla)", "value": "179d78d08cac27453ebf42d99a3ba759830d66f8", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094961, "uuid": "ae823949-e86d-4bc3-8c32-f65c2a7b6231", "comment": "Malware payload (AgentTesla)", "value": "b84490da1b738e2c9d9232e08f0417d754880f1bf55018155c7c3d748a130a2be54c30efcc134c6589e2aca318519dc5", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094961, "uuid": "d8fb19cd-11bb-4a4c-a7e9-47af58408f28", "value": "T16CA423A5DFDDC42FE7DECE4A4C186132342E8D88E8D98F917C52F349857324A256A623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094961, "uuid": "e01b743f-b007-4279-aa83-3b180f89bed8", "value": "12288:GiyZMhW9gZDIZv8Oio3LdvxHjCVonsHfAeZWvz:G12WB/Rv9jCVH/Amo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652094961, "uuid": "a84a27dc-3a09-44e3-9be8-ef67651cc4ce", "value": 492354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652094961, "uuid": "1aa867a3-e298-47b6-8565-30b9a4b14d53", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094961, "uuid": "9f5064d7-61ee-40ad-a613-1111c40d6253", "value": "Contract 2 Profoam.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b174fab9-cf34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652058576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058576, "uuid": "26313628-f738-4a22-a62f-b36d0999f8c0", "comment": "Malware payload (Mirai)", "value": "8a8511587c796560726c495768dcde74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058576, "uuid": "634aede1-6982-4718-a6db-34f8ab324ee7", "comment": "Malware payload (Mirai)", "value": "b5e605312267e9e4b2fc3947569d23b9aac690131dc8c1d571bc7549cfae1efd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058576, "uuid": "498c0945-0a00-4303-b725-1b4191bcbbad", "comment": "Malware payload (Mirai)", "value": "b56a5990f6d2270fd37007edd4268661604edfaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652058576, "uuid": "4296db43-3b40-4888-96c1-896dd84505de", "comment": "Malware payload (Mirai)", "value": "cf2c663c3dd67c04714915158753617fe0082670f1d20d366864dd3779fa96767d12d2903631d3d521d67698476aa085", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058576, "uuid": "df025f80-84a9-4fce-a1a9-99c060da599f", "value": "T1A4430842B8818A15C5D412BAFE2E11CD33136768E3DFB2139D106F257BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058576, "uuid": "fc03a627-2efc-4b62-955b-4a999acdb3f4", "value": "1536:IhnLPLZF+6GtG+iwW/ul3KTKIsbRkJLqI3itX+4KWj:UD+Ng++WlChsRX+4KWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652058576, "uuid": "225b593c-f3a5-4547-867f-9df2bbc5d654", "value": 60052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652058576, "uuid": "3da828d0-8964-4a8e-8527-58557ec4cb01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652058576, "uuid": "bf49155e-463a-4486-9093-964b8b316146", "value": "8a8511587c796560726c495768dcde74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d5fb95-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kutaki)", "timestamp": 1652084784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084784, "uuid": "2d4c1cc2-7e17-4b23-bf17-6123d356b547", "comment": "Malware payload (Kutaki)", "value": "3d1ab8ea27ac65a81e0f4cf09e5c3dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084784, "uuid": "e9c49117-b7dc-4410-85f9-392980642d99", "comment": "Malware payload (Kutaki)", "value": "b626826522cb18cec741b324a13d2b59c590b482efa73ecca4e93ec4ebd02405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084784, "uuid": "a3831eca-204f-417d-b88d-926d30f9d80b", "comment": "Malware payload (Kutaki)", "value": "6fb0d330cd8198b24a7aa241c2937c2798f42f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084784, "uuid": "e1404f5f-6fc3-4c54-b1df-1a2ca6bbf383", "comment": "Malware payload (Kutaki)", "value": "16bfed95a74eae1940fd8b4b97f8a4def9db99cf185fb476e7e0343fbfac9809e5e2d45179e7aa45935fdd80faa5270f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084784, "uuid": "321abe6d-e82c-41b2-b8ad-3d04628d6a28", "value": "T17B451207FB834A61EC6D6E706FD391D016A3B9AA1B57064FB740722978B0F912C58B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084784, "uuid": "46cbc510-164f-42bc-8647-0205726e4cc8", "value": "b5046d0cbaa5a4c738f3e5d31c133c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084784, "uuid": "9b0ad3df-eeef-4838-92b9-40e35659e3d3", "value": "24576:xyM8JTmsOe46D5tKERWpnhNjQlUPnGYI5aDMZfmP/UDMS08Ckn3z:YMsD46lgEshNjQmuYMaoZfmP/SA8Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084784, "uuid": "237b9d41-026f-4c64-98bf-889710946c77", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084784, "uuid": "f4e8bafe-ae0c-45cb-aa5c-36ba15fe8b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084784, "uuid": "528a11cb-ad9d-426c-80fa-2ac80e25fe19", "value": "Invoice_47399.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba96242-cfa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652106240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106240, "uuid": "a647667f-c2ce-4585-9ca2-ab52d2d65157", "comment": "Malware payload (Formbook)", "value": "a7d14f13f393e8afe32b2d4a6d4fc253", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106240, "uuid": "a49d0e8e-7349-4231-aaaa-eb39c1be6ef6", "comment": "Malware payload (Formbook)", "value": "b65471a885ff0bfdeea257dfc390024347f4cda281c48c3454cb2c17508e27a4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106240, "uuid": "2ce96f4f-c0c0-448d-893f-aebdb30d4528", "comment": "Malware payload (Formbook)", "value": "2637d0410747d9db36309dc28037ef76ef051d1e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106240, "uuid": "9044fc89-6dea-40b9-955e-93705dd7f422", "comment": "Malware payload (Formbook)", "value": "11b8100aea4c70054bbae998bbdbe6a14871249f603dbf0cf921fbfb8f3077e15581e4502448c3defb8cee7f17c502dd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106240, "uuid": "549cd12c-c106-4d1f-981d-9d924d6fafff", "value": "T1ABD4121A77D2A767D67157F16284834003F37E6D7062FB8E5E8325EF6AA2F090601B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106240, "uuid": "c7443c44-d4e6-4bda-8320-72bd3dc921e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106240, "uuid": "8d62458b-b296-487f-95a5-1ef38c6bf36d", "value": "12288:Q+9l2L2I+qo2PF1fstmQVzwpa3KrERLhkhk+yugqKwc3H0jStsWXj:lH2q8SnMuOERLhedgqKW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106240, "uuid": "8dd6be03-5e30-490d-9803-1f166272cb86", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106240, "uuid": "a2bcc55a-8cc3-461d-b8d5-05d648f99267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106240, "uuid": "cb085a9d-6d2f-4bba-a96d-3e96d2cc2f71", "value": "tbwfNCGmjcai1ay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b370acc-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652107072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107072, "uuid": "09cdf99a-3bb1-4f53-a023-a27479ae367d", "comment": "Malware payload (Formbook)", "value": "e3a553cb47abe9bb54f1df6a04361ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107072, "uuid": "306de6db-373d-4044-ae9e-35aa11df0e71", "comment": "Malware payload (Formbook)", "value": "b675c1a510216f6acc1a5b67fd8861eb4ce7793af5a885e719c92fedf959f7b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107072, "uuid": "7102ad6e-cbe2-441e-acb5-52bd3287e5c8", "comment": "Malware payload (Formbook)", "value": "2a9f820d4b29773ab10350121c98f9a87187e543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107072, "uuid": "e2e5d05d-caca-4dbf-8485-14d93af95553", "comment": "Malware payload (Formbook)", "value": "c73869f910036fb8dda26121d04f7201ca8188e9c70187dade544dd92e80b038589a0f43702fe48e0b4f2ac38b9eb1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107072, "uuid": "9b5cd8e1-3aca-4938-9a1d-fa721269a9f4", "value": "T17C936DA2FB067A26D8170B724522C2F02112BF103D2A56C7B64CF6592FF7C958D73B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107072, "uuid": "df562648-2387-4bc5-90ff-2f9d6ca0bcd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107072, "uuid": "becda320-3908-4197-bedf-e5ba46fe3d87", "value": "1536:Evmhqt/99jLXvclH9qGQR88oK/Zv34tFDHRjolE+DZPG:ImhO5LXvclH9L8PLZvwZADZPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107072, "uuid": "27fc389a-962f-40a4-81ee-8faeba1643d1", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107072, "uuid": "9bbb9ddb-97b9-4e1c-9767-4ea3733a0f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107072, "uuid": "295ebc7c-9270-4180-b8c4-06b0722acc08", "value": "e3a553cb47abe9bb54f1df6a04361ae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b25f83-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652105157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105157, "uuid": "38f7b2f1-baaf-49f1-94fd-dc888073ec6d", "comment": "Malware payload (Loki)", "value": "3b0e761f6f76e741fceb2ec2cdb90a22", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105157, "uuid": "856800fb-a227-4776-b933-5153d833228a", "comment": "Malware payload (Loki)", "value": "b67fb0b3e7835011e5040f1e0edba8a4b106542581ece69b686192924f32b1a5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105157, "uuid": "d8753e44-31b2-43ff-869a-a6bc65d4d585", "comment": "Malware payload (Loki)", "value": "9b656d6ce8178abfcd25d80881e4fecf716aacbd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105157, "uuid": "693fc77f-9bea-4706-95be-a61d661a91e6", "comment": "Malware payload (Loki)", "value": "37ba9a9844a28b22a96fcf7b5faea59897e5d5c20ea2b07257204e809b9829ec8e3fb50b9d73c2e5d98c61ce84bc658d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105157, "uuid": "d6be5a22-7345-42f2-874c-2b4896ef4619", "value": "T1032412227E0671DBCB78B0349BF826EC84FB4E516B62606464EB335990BE251FDAC710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105157, "uuid": "52144bbb-0376-4ace-89e3-49063c7e3e0d", "value": "6144:HL1GcrU0HYhd1xMWh7FlirnuYloQwVFgp:HLQcjHYbUWhlqFmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105157, "uuid": "b769beed-aa4d-4d46-b09e-5b4f0d73e7f2", "value": 210472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105157, "uuid": "03a5d120-25d0-44c0-a059-c84512e37900", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105157, "uuid": "a67c06a0-cdb7-4be7-a5a7-4a4bb28d13c2", "value": "PO0995.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24953d2c-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652107302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107302, "uuid": "6ccf0a42-8399-475f-8007-c22c67ca71ed", "comment": "Malware payload (Mirai)", "value": "e7f409b8bd1103107f8e0885b7aacbc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107302, "uuid": "279c25e9-61bc-4cd5-82b5-7523a080f924", "comment": "Malware payload (Mirai)", "value": "b72dcd6df8ca9aa68aabb0d220ab2c8e9913eecd4baac8a1bc8a25d6e9ca06ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107302, "uuid": "24087265-40a7-4057-9781-10c134f865ab", "comment": "Malware payload (Mirai)", "value": "83a93d60613491a5aed7a7117849929f36b7aee7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107302, "uuid": "b8f30d12-ec32-4ec6-946a-38fe8377fa40", "comment": "Malware payload (Mirai)", "value": "5918dcd647bb6768ccdbff5e595550a362f13047220515cb4c011cda95af2b0898b4e03d2f448409598a9af9f4173822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107302, "uuid": "cecbdd57-f163-4427-b9af-7d96f8b8f371", "value": "T1ED92D0A87159F930C3B0DC759C7AC2837AAF3FF8E2E5317614444138FA8B51798B9692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107302, "uuid": "deaff3fa-3dfc-4505-a1c1-9618076b1c42", "value": "384:ogbJkr3cD4TeFT5G+ZsTmcE9k20WKK4+eXFMoUkr84b2na1MChymdGUop5hu79:iytg+ZsTkN4+6lUko46nans3UozM79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107302, "uuid": "1b38ba51-4a5d-4b49-bd8c-90593e0600cb", "value": 21024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107302, "uuid": "9cde90e4-b195-4473-aadc-ef18d47f1451", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107302, "uuid": "8c2cb976-59ef-48c8-8e47-65fc97ff94df", "value": "e7f409b8bd1103107f8e0885b7aacbc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12976fc-cf7b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652089123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089123, "uuid": "f0bc538e-6576-4ae2-a19f-6bcf71a39719", "comment": "Malware payload", "value": "7aaad060b8267b0f1d470e35987c8139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089123, "uuid": "7418f421-045b-49d6-a313-0fbd18a90d8c", "comment": "Malware payload", "value": "b73873f0a3fa13d2ed96cc106c765a8ee1bdb95b1b67d6c9e3f887846b9cd116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089123, "uuid": "a99305ff-2d26-46f0-97d7-cc4b6e8c19ee", "comment": "Malware payload", "value": "713061b1030e289a2a564a7a58a5a5e35afdc5c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089123, "uuid": "8eb3e13d-cd38-4433-af04-8a3025314a89", "comment": "Malware payload", "value": "b51c12ff90b243ccb36316b63ca3ee2333e233228747cfb60b9f4bfd2084c1e30ec7cbddc02f3a1cf3eaf68dfd5ff68c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089123, "uuid": "0447973f-70bc-44c9-b31b-ef3d2a8aa889", "value": "T1CC963A03F85181E4C1EED1708666C2A2BA707C895F3427D72F60FBB92B76BD46A79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089123, "uuid": "e184c287-e69a-438a-88e2-4d0df87e806f", "value": "49152:hf4/utcmrb/TZvO90dL3BmAFd4A64nsfJFu8ogETf6OSW6yIhrLQ/bIjrrlRx452:Hpg91x45QQdK22/U6tYD3ECOwknR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089123, "uuid": "596d021f-1d06-4599-b03b-0096bc029714", "value": 8941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089123, "uuid": "9e30fd8f-2826-42aa-9613-5e864bd86308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089123, "uuid": "810bc37d-fdc9-4151-b281-3fff1d8cdf4d", "value": "me", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906ba3b4-cf60-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652077418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077418, "uuid": "c7fda676-3f46-40ba-9222-690050fe7626", "comment": "Malware payload (SnakeKeylogger)", "value": "f6d3b7f7b8716162c908437f48334ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077418, "uuid": "954534cc-dcea-4430-bc3d-cdac5addd4ae", "comment": "Malware payload (SnakeKeylogger)", "value": "b7d3d4ed6e94e9e2ad27b45d5d6b0c65dfe1716d76645c649d6896d5bfc874cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077418, "uuid": "80d2a204-d830-4150-9967-dcf31df5ee0c", "comment": "Malware payload (SnakeKeylogger)", "value": "339c8d8265c2a30cd70fc2804b4881a49d35e01b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077418, "uuid": "3f24ccb0-b15b-4b46-b055-8c89ac04de3c", "comment": "Malware payload (SnakeKeylogger)", "value": "3c9f60bedf8ea2988e84a169107fd4bf42f03b06e7391717678e77226d828c8d7f6aaec302d1320f3918aa59fc0c9f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077418, "uuid": "43b2edb3-4628-4b4d-9f32-63c7698f25d5", "value": "T163C48CAC765075EFC817CD76CAA82C64FA6064BB530BE203A41716ED9A0D99BDF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077418, "uuid": "e0ae5466-1ea8-465a-a01b-252405199449", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077418, "uuid": "f0427575-b34c-4078-b0a3-a0759f8f5979", "value": "12288:qgiWzPqoY6+NM8MinMemExOoxdNHzZ0SXwVZSfwhbJty70/V+rQ9asp5Y:qHSPpY5NlMinMemExOo9HzZJXwVZSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077418, "uuid": "1d0159bc-91a7-472f-a718-45fa82a235e4", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077418, "uuid": "1b6f68aa-01cc-42c5-9c19-c13470147533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077418, "uuid": "96ac6e96-dc38-4c09-91f7-eb74622b8a9c", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fb30a7-cfab-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652109714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109714, "uuid": "8bb69766-0fe2-4bc5-84fe-0fac5650271a", "comment": "Malware payload (DCRat)", "value": "088a9125ef5c0d2cd9186badc2db9ad5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109714, "uuid": "53eb5fec-2984-4c6e-aa9a-e1fdb4091912", "comment": "Malware payload (DCRat)", "value": "b82a960cdf20c80dfd0beaa9a6d53808c0d63f524167688a5575d8f384d57053", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109714, "uuid": "cb562ee2-249c-4cae-8821-f7a4b563665b", "comment": "Malware payload (DCRat)", "value": "cf5cad7c4cd7e02e32d76a33fe1639393d5323e7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109714, "uuid": "7861547c-504e-4ed0-9114-5551925b55dd", "comment": "Malware payload (DCRat)", "value": "cb7c33f20f615509813491e799f5614ed91cba55997db31639b6dce7df9a27d4f32bcc98cda23cf6c8f6095fe12012a8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109714, "uuid": "0a2ae632-82cd-4e53-9fae-281c8b48e6ca", "value": "T1A0B523577DC08470D89115790AE68B30793D7D300B7B8EE7A7596F2EAA212E14B37F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109714, "uuid": "d39d6a1e-54fd-41e9-9e74-246da0767649", "value": "ab9ff6e4872ea2766a5f5c6af5649e9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109714, "uuid": "f808e735-5314-4dd0-b1d2-ae811116c2d1", "value": "49152:4J4cewwEkyE4AnDWpRd7aGptVoe++bTuCm+ug14Rnt:4J4V5EkJARksTtjnmWCRnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109714, "uuid": "d89a8f5d-b18e-4786-bca9-6e06e0038df1", "value": 2430385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109714, "uuid": "b04c1236-98e8-4773-a6a5-b36a12e86b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109714, "uuid": "85033415-7d32-4c22-82d4-90447a86bc6b", "value": "088a9125ef5c0d2cd9186badc2db9ad5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43ce8fe-cfaf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652111516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111516, "uuid": "db6d082d-5fe5-4be9-bfde-cfe276e69ae4", "comment": "Malware payload", "value": "70349d2833db4a1cb0f1abd72d614e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111516, "uuid": "ff4aa61a-20fa-4388-b75d-2309f7df8431", "comment": "Malware payload", "value": "b832d3983b1df683942f4de4bf832c9bf727ff7fafffe6dcb526a9a1d66b8226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111516, "uuid": "4d39a25d-2ca7-4321-b8c4-1d9130d9cd22", "comment": "Malware payload", "value": "1744568c282700789fb3a13d96e5b4cd1be76ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111516, "uuid": "0116d79a-d45b-4af0-8991-b7b9d7303eac", "comment": "Malware payload", "value": "b531b0ba154f581cd4e0a243556c645a55459462f7761fc015011abe914bf0f54b6f86f8dcc3d96971e2fd9baa28b380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111516, "uuid": "8cf07518-90de-4a6f-ac01-1c38346280be", "value": "T17A24B0A1CB48C8F0F4B60D35D133DD519D72FC254CF9C92FE59A862E7432782991AA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111516, "uuid": "b30b8b9f-4740-41bf-991c-b0633f2b352b", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111516, "uuid": "0b30a4e8-50fd-4076-a31b-2d1a4b2444e9", "value": "3072:PweqOYEUXPne96iLOSHkSJiVgXYmyckB+6nqYx+bY3eAc+LQ:YEUXZilHtIaHycA+61sYuuLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652111516, "uuid": "cc029efe-4e76-4f26-9e4d-e1cd25c74eaf", "value": 216297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652111516, "uuid": "7dab82cb-4b99-48cf-a801-908c0af7784e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111516, "uuid": "40a02ba0-00cb-4c4f-a59b-200128531448", "value": "SecuriteInfo.com.PUA.Toolbar.Conduit.14449.3756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8c680c-cf80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652091236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652091236, "uuid": "183ee05c-8841-47be-9cb1-81b03b94cd20", "comment": "Malware payload (Loki)", "value": "389863934962f228f5360e8dea40504c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652091236, "uuid": "17799def-c5da-4199-babc-b63b40d13e5c", "comment": "Malware payload (Loki)", "value": "b99511952c5759fc99e72aa04c60d2b896201463f71ed0c5d56726382b6a8ec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652091236, "uuid": "63f07b61-7700-4b83-975d-16f40578e3a6", "comment": "Malware payload (Loki)", "value": "8644b318f5ecf7dd3ad21923653a092ac49f3bf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652091236, "uuid": "5047b4a9-2934-4c84-8d44-fa73f9049465", "comment": "Malware payload (Loki)", "value": "7ee00caf70cd9c2cabaaef110b92cec0e68dd427a006f2b18f4ee5c53b71b1b5ddb5308cd0b8649081b4509f48d1bd4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652091236, "uuid": "9b7f2125-1081-448b-95ef-25dc18a8d522", "value": "T178959D017398DB55E1ED373AE3EA651413B2E5931F62CA89BB4D77A108222636D0F31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652091236, "uuid": "3b6892f8-df48-4b41-a412-97302fd6216e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652091236, "uuid": "fc8b5552-05ad-41ea-9f5f-ce59cf7d5db0", "value": "49152:8aTp34iffW+S1V1LbNdVrfdpSHqeFRAoiOcZQuAHL72AHLvofe2SX9qf0dWvOo+V:FcARrI9oelJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652091236, "uuid": "1f70161f-44db-42c5-acd9-015ed7a4f554", "value": 1907712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652091236, "uuid": "b1781ce5-96b6-4d2d-80c9-73c7ee0fa19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652091236, "uuid": "56af565c-007f-42b8-bc56-191730fb10ba", "value": "BAHAM_Order#008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7cc3cd-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652084795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084795, "uuid": "b59290f9-8f28-4963-a266-2539a000bdb3", "comment": "Malware payload (RemcosRAT)", "value": "f38e504fbd59c1a0e71a4d2e381c3f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084795, "uuid": "457c5dc4-4be0-4aab-9ee2-cea870762fc1", "comment": "Malware payload (RemcosRAT)", "value": "ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084795, "uuid": "a184577c-7454-45cc-93c2-3d3350ff46aa", "comment": "Malware payload (RemcosRAT)", "value": "90d915f7953812ca0153a8e4a65c0e65a96c6fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084795, "uuid": "b939a029-2783-418f-95c3-ca8e58bb02fb", "comment": "Malware payload (RemcosRAT)", "value": "62e4fd6f6e0ba1baba09eefd3fb03a5573becf198c924ec995a6dd154435e34437e5020b043e304f3bdc53397e622dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084795, "uuid": "bd2aaebc-6922-4f04-8035-d6f5c99d9a3e", "value": "T137B412617A19C48FE9E13AF504BDA9A36A656CB12470825F9BF07F753832943CC8D32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084795, "uuid": "e4a2ccc0-3146-4912-a454-496e1ccc5529", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084795, "uuid": "15748270-ba83-44c1-b147-3a409dc7779b", "value": "12288:oNFYTACwfv7FOQHTjcGYRVFjaGeUSNZmlOE:oNFYTADfvRXzgPRTffl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084795, "uuid": "a4ffdbc9-e0e6-4f3a-8fb1-a6cb6c3c6e9a", "value": 512095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084795, "uuid": "861c701c-8c63-45cb-88c1-1231ae8ae16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084795, "uuid": "30076372-223d-4d45-84ca-8f20090e3702", "value": "( PRE-ALERT) BL INF222300126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdd74db-cfe1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652133004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133004, "uuid": "0d406286-1f0c-4105-bd74-20f60bb5aded", "comment": "Malware payload (Mirai)", "value": "a943cde47e7bf2169ce748cf65d4f81f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133004, "uuid": "f8b280db-4c24-437a-915f-675584c465a1", "comment": "Malware payload (Mirai)", "value": "baf1e69cb5de8531764a249ada742782ba4309ed1c376b7246b6ad9a7517b236", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133004, "uuid": "27a2841a-3a14-4f22-8916-9fd27d9ec08f", "comment": "Malware payload (Mirai)", "value": "04e04466f1a36cc0ee137f4d76a97f9dbc25f694", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133004, "uuid": "dcc5ba02-0615-4409-a222-8db8850f881e", "comment": "Malware payload (Mirai)", "value": "6f80edc829a973b2c92dd1509081efdaa7e53517c33335d1c856fab87954e6a31d1437e4fa2a9536f6c4c03737a33c28", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133004, "uuid": "1e3c2814-086f-4da8-8be4-5e477801772f", "value": "T15A735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133004, "uuid": "449b1a78-de3c-4175-8e6b-c6d406d1e800", "value": "1536:b/DYQYs1ZokODichmN15UzOHIt09KfsH18ruUGDKVQSi:zDhzUkODichmBUzk40Y0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652133004, "uuid": "006daa63-544a-4574-a819-c6fb2b054dd6", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652133004, "uuid": "1de8546c-f3ed-46c6-ac03-0c0b05d06866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133004, "uuid": "2c09fc17-b147-4c56-882c-768ff6fbb591", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11909a87-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104264, "uuid": "4522c377-9a68-42da-bcb7-9d876e83f4af", "comment": "Malware payload (SnakeKeylogger)", "value": "0ccce183e7e63254b5e1722080a2f452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104264, "uuid": "a0074cd2-5a52-4835-9bbd-281189802b5c", "comment": "Malware payload (SnakeKeylogger)", "value": "bb0373bf30593baa5f750f121da34759a5c268859476fd659d241593af0c1ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104264, "uuid": "3bf9f808-3246-406d-9b5b-ca673cbb09c4", "comment": "Malware payload (SnakeKeylogger)", "value": "17297979c85ab3700471bb44a68c7fd669d9065b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104264, "uuid": "9c78175b-b7c6-40fc-afd6-c16a70efa3c4", "comment": "Malware payload (SnakeKeylogger)", "value": "86e3a75361152410124b9506ffaa7fbbfc4dd90317dc2a1c5201ac36982f8d0fa2a70c83518bbc597d082785ae08f3c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104264, "uuid": "113a415f-5562-425a-bad2-39040819d6f3", "value": "T10E03D7113344C2B3CAAD4E35D84B49F009749E62E724D63B69C5BF4EBC723B05E21EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104264, "uuid": "edfbaa0f-d454-473d-808a-9e58977f7ac3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104264, "uuid": "c5be60d2-4d47-46d8-b82f-8550d6986767", "value": "768:m+/XRg5E+DfS4aGDgAR774lFtCqpix7z9veq:DZ+DSsDRVOP/pa7zgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104264, "uuid": "20a54361-d8cb-4ae0-8b52-4ead35836208", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104264, "uuid": "31993466-699d-41f4-aa71-60feedb9c27c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104264, "uuid": "c701fdef-5172-49d5-aec3-10a5ab38a3db", "value": "0ccce183e7e63254b5e1722080a2f452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ba9f20-cfa7-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652108026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108026, "uuid": "1f75b5f3-dd20-485a-b220-03ada9bf3230", "comment": "Malware payload (SnakeKeylogger)", "value": "e23371012c3ee9090f5c8a690a67eb26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108026, "uuid": "379ea7b1-42e5-4d43-ac9c-c7fc3d518e16", "comment": "Malware payload (SnakeKeylogger)", "value": "bbaa176939b86a8958e9990c56a47a2199e59b6e204e09cd1b18fdbcb25fdd4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108026, "uuid": "30ec9346-3ca3-45aa-9109-47c0c4fa8b41", "comment": "Malware payload (SnakeKeylogger)", "value": "9af1f37e9ce1c20248cf5b679ed28c9cf0d9b1fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108026, "uuid": "bf82dada-4926-4543-83ba-772baa42cb66", "comment": "Malware payload (SnakeKeylogger)", "value": "bff233f9cfb4efa121bc1eb4656ccef495e016b4f7b0a9140558390d50ad740dedfdb9214e298ceddd05d48c555cf081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108026, "uuid": "05de8490-1019-4512-9ac1-e242b37042ae", "value": "T113F4CFAC72507AEFCC67C6BA89A82CA0A761347B535B9243902315ED9D0DAD7CF144F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108026, "uuid": "f96f07e5-eae4-496d-b4b5-fbfdac1480cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108026, "uuid": "6ae80bb0-d8ad-4b6c-af39-512aa1cdd184", "value": "12288:rg2L2I/TB81YvqZc+nhTW39aI6HOAIDjZgOcFE3V5Jvu3a4DINdVVz/EYrA0QeA1:c278Uq6+nm9aI6HOA8yOrBwDINxsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652108026, "uuid": "49ead03f-b7da-4df2-a29c-093520f0b665", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652108026, "uuid": "c120465f-6984-4490-9f65-3d60f3f31072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108026, "uuid": "6d16e0cd-9b49-4c9f-b8af-fb63114c3d71", "value": "Antawise.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901c200a-cf7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652089014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089014, "uuid": "790b7f21-fe88-4740-ae26-d39fdf7a0845", "comment": "Malware payload (Formbook)", "value": "ea0be875596d36984a01cfb843fd722c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089014, "uuid": "0293ba7a-08e5-4eea-a7df-555d37df1c04", "comment": "Malware payload (Formbook)", "value": "bc0ddfa3a0da9587325b11d866e65b1cfb07ea88556561ce9dd3e0784857e52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089014, "uuid": "a2d66716-1d47-4084-9217-f9ef858a1cc2", "comment": "Malware payload (Formbook)", "value": "ce3146d914e80cf552088d55778e849f14721f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652089014, "uuid": "6efece64-8e86-4dd4-8419-8eb0dbbec14c", "comment": "Malware payload (Formbook)", "value": "541cb57aa7526240acb8d870c0097137949c04e6b1ea57e447045b0464a340259a7506eced77962132d29b2c49b1e17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089014, "uuid": "cabe7f57-e963-4944-bcfa-da888e04a416", "value": "T117D4122C77B583B3C27A97F590D2528017F23E7D7262F75D2D8926DE1062F064A42EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089014, "uuid": "fc36e431-29fd-4fe2-a83c-c647b944eca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089014, "uuid": "d5ff099d-8ba5-4271-a81a-af0e0982960e", "value": "12288:Wc42L2I3OOS2Y3NxOlldUq9phqXV0zICS3D37KRtLgQterrLvnv:+2h1SF+lldUG4XIICSP0tivv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652089014, "uuid": "9a3b2f18-3859-4ee4-9d13-1efb85632488", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652089014, "uuid": "967ba11e-20c5-4b51-aea6-60e91da6c48a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652089014, "uuid": "a529a3e6-091f-46a6-83aa-2ee9947529a6", "value": "SecuriteInfo.com.W32.AIDetectNet.01.21639.26895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdd9311-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652107106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107106, "uuid": "768a5775-19c0-4657-b8a4-cf17b1b173e3", "comment": "Malware payload", "value": "f5027e001e93ab208c1df58c078fe054", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107106, "uuid": "92027bc6-88f1-47e5-8031-1981420e7f8e", "comment": "Malware payload", "value": "bd216f3aca41f7db112be475c43c84fb48d377f40c4e23a09c9d9460330dd9bd", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107106, "uuid": "78cc9e5d-86bc-4259-9adb-cc3b8efa6887", "comment": "Malware payload", "value": "10e5e91cd5e0b8d7f5143823526ac43139f1c2e0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107106, "uuid": "19d419d6-b0fd-4492-b7c5-163fe8eed059", "comment": "Malware payload", "value": "1c8239acf6ea845862fc360846a05612d9ea866804fac6dadd82639c59bd8e19414af07d1efbd24777f36554414ed8f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107106, "uuid": "3a932c18-bfc1-4814-95d1-d2c7c7b831af", "value": "T1E64612C1EFC296F2E58109FC4096E62ADA247E1D3737D5E393D028C164E29D15A3D2AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107106, "uuid": "92f45734-de28-43b0-b377-b3f6ad6e6e0d", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107106, "uuid": "cdec65fc-c4ac-4824-a47b-dce56c4d60a8", "value": "98304:pT/ufsfavAxx4HTOWEXmd8YAupePboi0Hh662LxjYarcYoosyi1bFZVUYRP:9uUfUAb4HT5ahuwTuQVjfQDhZZVZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107106, "uuid": "6d1a7a80-6350-4b4a-b046-f4d2b338a7ff", "value": 5807408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107106, "uuid": "5c58bd00-4937-4487-9557-fd2ca85db0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107106, "uuid": "e7cc9b99-6146-4b62-a015-e6afa8f1bdae", "value": "Shadowsocks-4.4.0.185(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6e9f57-cfa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652106138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106138, "uuid": "b63e1345-091e-44d8-a156-122d06289cba", "comment": "Malware payload (AgentTesla)", "value": "c09c2527b2e6ee7eacb1135071e46f2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106138, "uuid": "4f3ffb10-e0e1-4b06-bdb7-06688e31a47a", "comment": "Malware payload (AgentTesla)", "value": "bd674e24a7f52462b656e2a402ea52fae7ae128e67d8ef3c4de5f16bb43da1b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106138, "uuid": "f62489f7-c129-414e-9dd4-8fbcb46c1545", "comment": "Malware payload (AgentTesla)", "value": "cbfdbfa4e165d1cc9779d1761a149dd57a810a36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106138, "uuid": "a2b801d9-fc46-4eb1-b752-a5ec97a380b0", "comment": "Malware payload (AgentTesla)", "value": "94c68286f23e3c5523a30cedf2e1818e9ce144675fc2c54d98acb66fbf0b7a3933771be46c53cc5778b7977800c6a558", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106138, "uuid": "04b355e3-48d0-4907-b452-b4d9869d6045", "value": "T129B423225AC198487BB2FDE01F982F85D74B10FE3B491A6B1BD5B675BD12004BE8F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106138, "uuid": "b62dff7f-45ff-4d09-8c13-32951578da18", "value": "12288:M5sIrE+ScwezpJvu3Kbr+jNcBmSJ2tIpfM1i9vL6Uc9+o0:MqIrE3cdeKbr+jNcBm2YI5M1iJG9b0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106138, "uuid": "dd322c5f-ee24-45ed-9eac-61da86c6fad0", "value": 510662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106138, "uuid": "147047bd-a586-42e6-8472-c249f902e980", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106138, "uuid": "562d98dd-a421-4674-8de4-bd47bcceacf4", "value": "Statement of account# 200122001100.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60ec8eb-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652110606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110606, "uuid": "3355e48e-6e36-4f66-a13c-58c29f25d689", "comment": "Malware payload (Formbook)", "value": "bfa637818ea9c3af0e5a30bda8b4436a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110606, "uuid": "0b9ad033-4faf-4d04-9e29-ed456076b4df", "comment": "Malware payload (Formbook)", "value": "bd9d5262381f0047565bc4bab49a846673c66872a627658541101feb386cec77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110606, "uuid": "92b52f54-5b86-45b6-a318-2741c685bf0e", "comment": "Malware payload (Formbook)", "value": "d19920a0b709309d051370546ae3e33bde85feb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110606, "uuid": "93ad036e-bbd6-46d1-a3b0-df0bcc3b26bb", "comment": "Malware payload (Formbook)", "value": "d42e85c0e49d8f8fdfe2c331a344bd78ee99d986279597aebbce5a6d865acf6104e7df1a289d7a3b63019aab58787e10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110606, "uuid": "0ff035ad-81bb-493a-b684-918b44932135", "value": "T11244135626A0C477E86349316D76BB672EFEB20120F4D36727105BDF7176281EB0E31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110606, "uuid": "e1916d9a-2618-438d-abc3-8194dbcbdd8e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110606, "uuid": "c4d6a6e0-15ec-4461-ae70-21f956cba8e0", "value": "6144:HNeZmeD+74hRHBYE051gxs5WalJjsFSrUw57Ra:HNleCaKnzgupzPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110606, "uuid": "e8b51500-7737-4b7a-b1a7-6a0457a02727", "value": 254942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110606, "uuid": "81ce1bb5-2f19-4af4-8906-dd9f6ec465cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110606, "uuid": "f2480461-1499-46d4-8f81-1e6a77939ab0", "value": "bfa637818ea9c3af0e5a30bda8b4436a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dfc9fd-cf72-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652084917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084917, "uuid": "0157bce8-14b4-4b46-9e95-f021b7f63389", "comment": "Malware payload (Formbook)", "value": "6622ea3299728065221dfd7e18105248", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084917, "uuid": "e5e466e6-0994-43de-b3cb-f1228f774282", "comment": "Malware payload (Formbook)", "value": "be6bbf6ffbea93e6176181235db4540909a6a02c985b21a633c01a19617f04fa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084917, "uuid": "5c3b96ee-ffcc-48fa-8aff-044a97b8fc26", "comment": "Malware payload (Formbook)", "value": "3a45fd2199523bd08b6998c4c6f4b112268e9c8a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084917, "uuid": "c1bf63bb-c495-4bd3-92c4-23355c924c74", "comment": "Malware payload (Formbook)", "value": "4ce6b1b1020421d494b1bb75e97f403c4894c55f66bc35cfbc9a13a16548678f265f4f6cddf809267048f6d0c3695f0b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084917, "uuid": "228ddee0-3c0a-47e3-a9c2-6b19c6e3b3e7", "value": "T16092D0B78B0D8B6CCD621B36084CB5CB727766811E5E56320BE810751F829ED38A5E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084917, "uuid": "53780e5f-c0ad-42a3-adac-0ba5e6370da1", "value": "384:Lu8nFPKl3E99rTI4stWTOP/OLVj0f0IznXM7q/8d0NKhOKOcyEogwjzH6zIYB:L1S3+9rszWTeW540OXM7NhOlcynlbzYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084917, "uuid": "8205fc0d-adac-4a4c-b632-72c55725a60d", "value": 20351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084917, "uuid": "2e1cc694-e078-4d5a-b1f5-bd9b6d377e1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084917, "uuid": "9e8bd22a-dc4e-4329-bf96-859a1aafc14e", "value": "ADOC RFQ-WCMS-1800865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee8f45b-cf76-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652086945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086945, "uuid": "8fcd4787-6fd4-46c3-aa67-6ee20d6a5c93", "comment": "Malware payload (Mirai)", "value": "d136dc98d9f6f6fc63b4771634276898", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086945, "uuid": "8cef74b9-ed02-4714-bb94-5c98c5a6c49b", "comment": "Malware payload (Mirai)", "value": "be82058f9e22d06ab1db20f367f4d721dc6233fc6bcb267110660a5fc81b4f02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086945, "uuid": "6b708c65-7b2f-4b68-b0e2-f9e5ddd399b9", "comment": "Malware payload (Mirai)", "value": "79927b73d73c18ddf13a58305e85eb46ffca8cf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086945, "uuid": "578bfc60-c3bd-4348-8167-30c78c416c35", "comment": "Malware payload (Mirai)", "value": "75bb94c6c619ce788b9d2de5d370ce29e0ffc304ae55af301a355538db497c09495d905fe5eca1a85ec27e9a738dbcc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086945, "uuid": "f26f434e-d36e-4b4a-a46c-df14b32c5670", "value": "T12483D81A6E21CFEDF7AD863487B74A21A75833C537E1C685D26CEA011F7024D241FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086945, "uuid": "ec851973-9eda-43bf-8ae5-0a52d8b8c3f1", "value": "1536:Dnh6SqHHXIqOBnZc6zDw6dKZYwNTA3iOtenezfyTVh:DnhqYqYnr2ZhE3iOtjyTVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652086945, "uuid": "86c9435c-e7fe-454b-a3a5-82d6de416542", "value": 80872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652086945, "uuid": "daeb35f6-9944-436c-a722-532ddceef7ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086945, "uuid": "5535a09d-4244-4527-a7fa-2e47da1df792", "value": "d136dc98d9f6f6fc63b4771634276898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6339e1ce-cfbd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117286, "uuid": "fa6052eb-25d9-4071-a4c1-25c9878d4a12", "comment": "Malware payload", "value": "59e2fe6f9a9e8d8cdec473957b52362e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117286, "uuid": "a9197e93-b370-4f19-8390-bc7c0cfbff65", "comment": "Malware payload", "value": "bf1628d90414b652f375dafb9db7839d2e9580030227fcd34c987189d55880da", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117286, "uuid": "93a8e7c6-d581-4473-9b15-c9a18ebfeb6f", "comment": "Malware payload", "value": "4c3814eacbe76a49bbb582649c7a839f2853b9b4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117286, "uuid": "8fcb854f-ccc1-4e63-bb46-0d93f2745792", "comment": "Malware payload", "value": "ab8bf79383b9a8c2e8736213fced83bbb24707ee91530bc3b623225ccffe977fa1ceb501e1e16eb0900db6e9fde426f6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117286, "uuid": "06d6ae52-8f48-44a3-ae3e-242d0bc3eb5b", "value": "T1C77283BC21FE487B1253C7B5C8668A6DDCD7265D9F30ACE3B2374A07362D296802705E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117286, "uuid": "a93f7b0a-d803-4c4a-8cdc-680f3066454a", "value": "48:3upoYohYC7p+/yi/OL2eJNm9aS9giG/VzyIu//Rp:+O06i/kNm9UiG9Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117286, "uuid": "9eb83866-5dd5-4e33-8da2-af39922072a2", "value": 16247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117286, "uuid": "3e3eafd2-952c-4817-a02f-300da9d3eb41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117286, "uuid": "b865ec2d-79f1-4d55-a449-8299c3894f5f", "value": "Protected Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1cf31d-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652110560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110560, "uuid": "38d6388e-22c3-4fc6-8f11-30d5530908f7", "comment": "Malware payload", "value": "19178b45f2384c36bb62952972871068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110560, "uuid": "bbbd90da-b736-4dbf-839a-37613d6bac40", "comment": "Malware payload", "value": "bf3e7b08e131f9ff5b860058ae7afc405d95a718f6c65cbc239dd35ec0f39d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110560, "uuid": "77f66b1f-f5e6-4731-a50f-3192637151c7", "comment": "Malware payload", "value": "dbda3dfb25d8ac421c771e4ae7420caebb05a539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110560, "uuid": "efbb1119-1cdf-4daf-ae28-d98a7b18d2b9", "comment": "Malware payload", "value": "3508defc1b535d8c6eba882090a40e3e44d0b154fb3a5577b90072ea0bfeadec2a4ef60dadd993e55e587da288264d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110560, "uuid": "56dfa2f9-5f9a-44ca-a441-026725121bd0", "value": "T16CA47B21261CAB11D13ADB351583C17153F7A84FBA22E23ABEE37CBF3545B01C663A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110560, "uuid": "fe4b597d-06b7-4995-a823-b560493af805", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110560, "uuid": "b2efc2b4-a813-43d1-935c-b48cf88a72cb", "value": "6144:WQkA42WTy9IY3ZE+MWjZofDYkdnq60uvnHyjxOgLz1dtmqe:WgCyWYpM+oMKnV0uvHyj8Ez1Cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110560, "uuid": "fe05331f-7d52-44b8-809f-d0d09d5f0f75", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110560, "uuid": "28ee9ff0-dc4c-4377-a39d-9a5632cf8719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110560, "uuid": "b5dd94d5-7d34-4f35-a46f-2261c13ee978", "value": "Quotation Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6a1186-cf9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652104149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104149, "uuid": "db41a82c-65a2-4955-b222-26c4f7a64041", "comment": "Malware payload (Formbook)", "value": "72bf917b0921a77d8f4fe506e4585aa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104149, "uuid": "d1b890e5-4421-48d5-b929-5e16d9245fb1", "comment": "Malware payload (Formbook)", "value": "bfb053e1d122d83c47194c446ec1f14434ae8e95395a6b4df48bf9482bc8a30d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104149, "uuid": "0e644df7-805b-4dd1-86c7-bd06f6dbc751", "comment": "Malware payload (Formbook)", "value": "fd0bb6aac9c6752de713e42c594f6fa30a27e17f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104149, "uuid": "9b799551-7e40-427c-ae3d-71d72c98dd09", "comment": "Malware payload (Formbook)", "value": "d5318c699616674f2b6b1a7230e51fbbd79b796c2016a2fe963d18777a10ba97fb05ccb5ed6e6f61a5357bc2e0a3ec0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104149, "uuid": "a8515fcc-c468-48a2-8810-8a195d80b681", "value": "T1D134125592E2D437C9F612354E3CD72D97FEEB221099820B5B208F48BC77AE29D0E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104149, "uuid": "dc51a4f3-1046-4c50-9faa-59e8f1543003", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104149, "uuid": "d9bd0e58-6f3e-48c6-b9c5-7a39674e3c04", "value": "3072:l1NjcVVnLpPunbQn6AIcYeGfqyQvryJ8epUNV9PgNTJz1TICEpCXRch1dsk4IFny:HNeZmQn6NcYdfqyJnsPgHRC1drRnAmTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104149, "uuid": "dc4942a1-8eb3-49d1-9f0e-0e7f1bbae9a1", "value": 230360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104149, "uuid": "37771d5a-8fac-486a-9f4d-5cf8b02b0b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104149, "uuid": "156d971b-735f-41c3-986a-faa10968c373", "value": "72bf917b0921a77d8f4fe506e4585aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7cd249-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652109844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109844, "uuid": "fd90b60c-95e8-4ac1-9f4d-6b041e76698e", "comment": "Malware payload", "value": "362d86a436ce5f3032bbe90f3633ad28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109844, "uuid": "7ee21314-5f3e-4c27-bf06-5ff05876fc95", "comment": "Malware payload", "value": "c0526f6b41425bae4f66d319cd9b00e99040ca8f27048b5263145863ff5468f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109844, "uuid": "dcc64214-ae3c-4e96-9564-235a9a3289ff", "comment": "Malware payload", "value": "3c9d4a4273d38b0fb17d2b0e579c1fdc38c11144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109844, "uuid": "16712ffa-0c9a-4d41-a765-66feae857275", "comment": "Malware payload", "value": "75f5b081d9c38ea490288d4d4ea65f857e29cc6fac46368b32522ba84c5b5d91511be0788fb619cfedaf532fd91cbf2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109844, "uuid": "2a0aac78-2aae-4c4d-9aba-11ea04246845", "value": "T143C3ECE0B1679F42E97D93F5945060D803B56DE638F3E320DCCA70DA267DB982980D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109844, "uuid": "b685f683-130b-4e90-8584-af856974c79e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109844, "uuid": "3ae0f801-eeae-428c-861f-3d7dde8c6901", "value": "768:MpmPnCbZxCUVIeERAkUdmcscRuFxKljQJKiLYHo5C52uQTfjvbgKh7Ad+jmrAAev:cmPnCbZx5LEF53dj/h7i5AvOCz9s94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109844, "uuid": "95a3730f-8f37-4cd7-9bb1-37f2500c4f26", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109844, "uuid": "1952d11a-ec20-487e-ab7a-0631bfce21e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109844, "uuid": "17b89043-7554-4528-995f-a8b6f72a2279", "value": "362d86a436ce5f3032bbe90f3633ad28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6968919a-cfd2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652126316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126316, "uuid": "9e2382f2-6944-49d4-9226-53a0006e62a2", "comment": "Malware payload", "value": "e8f0d33109448f877a0e532b1a27131a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126316, "uuid": "94c6b7fb-85f9-4996-b248-d298a2d5bb41", "comment": "Malware payload", "value": "c0a13af59e578b77e82fe0bc87301f93fc2ccf0adce450087121cb32f218092c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126316, "uuid": "73318ad1-ab57-4ccf-8701-3bceebb676ee", "comment": "Malware payload", "value": "bfcfa72ba5095fba108314c1c4deb5faed82ef4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126316, "uuid": "03419982-4104-40a2-88d0-b47d65ee59f0", "comment": "Malware payload", "value": "7681bc0b14001a37919db62e44ae6a867242040369e01a48d33ecd70e394b9b9ab3179a87bedb028694bf8e610ffa005", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "QNAPworm", "colour": "#35FF7C", "exportable": true, "hide_tag": false }, { "name": "Raspberry Robin", "colour": "#46A56C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126316, "uuid": "26e8ae9c-9198-4a67-9049-5d593c594296", "value": "T15875330C5AD59576F0C1F3BDE9196F0A8AC82BDC7417EB1763F8B42F051A6B489A8D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126316, "uuid": "94d70494-001d-45cd-b616-750aa3f81f4e", "value": "24576:kJ7/8xVval1XgaoVhfi1org12hyL9mzkgtHr3RCL4YH5zRg12HHLjJvTusKxKnRf:Xli2hyL9mYgB3q4Yv82XlLK8dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126316, "uuid": "92386629-ea46-4708-88ca-b746883451fe", "value": 1579008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126316, "uuid": "4f4cce7e-8a64-474b-857a-f5dddfd8f46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126316, "uuid": "081381a7-7b01-408d-ad80-2bb5f4dd8ab6", "value": "test.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0228d860-cfb2-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652112398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112398, "uuid": "1d640c40-d4f2-4ac4-8205-c0326aecf909", "comment": "Malware payload (RedLineStealer)", "value": "0b446cb0bd7e31bbf451015c2e39e781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112398, "uuid": "cc35c194-aa1c-4599-9fef-cc1d40649159", "comment": "Malware payload (RedLineStealer)", "value": "c1a148b5b4a614617a82185de64a9160501fffa9c237dc64fe0985b810cecca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112398, "uuid": "a07c35d6-a848-40d0-9631-951f0bcc5b0a", "comment": "Malware payload (RedLineStealer)", "value": "f68d3f58d0a9ecb0fb614d5dbfb6d54471339d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652112398, "uuid": "f9b7e1e2-ddc3-4dd0-823f-3df8eb6f58f0", "comment": "Malware payload (RedLineStealer)", "value": "1cae358cf36debf744359268c77325cd837a218d40749f9ca1052d8c569ae723ec8e76555f6489644323a2eb9679efda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112398, "uuid": "ae4ed7dc-ef80-4371-a09b-5ec07b246f59", "value": "T1BC34AD217AD0CC31D4E70A308870D6A51EBEBC625B7449CB77A43B2E2E712D25AB7357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112398, "uuid": "9868fe32-7d05-40b4-ad09-ab761540119b", "value": "40a1f98470743985fa58a3c375a56fcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112398, "uuid": "587a8a40-28f9-4b09-b0bd-6ecaf0f2fb05", "value": "1536:cLjw4dMB7oJKIHXlMVMPnKot3kerTxEilXko5rghgbff6aB6s1+MyN08bQgbzD6S:cA41z3lAMhPrttNko5rCgGbN088M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652112398, "uuid": "0efe4b62-24fd-48ff-a923-d99ecf640aac", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652112398, "uuid": "96c980f4-f351-4155-8ce5-3451610852f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652112398, "uuid": "0fe01baa-c41a-4450-a4b4-5b47e687d015", "value": "0b446cb0bd7e31bbf451015c2e39e781.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b06d00-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652084777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084777, "uuid": "f4eb9c9d-c051-4ea9-af91-30e97ae80429", "comment": "Malware payload (NanoCore)", "value": "0c2bcc0df599b5a9406b9a9419d59d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084777, "uuid": "5df7da50-5bc4-4dd0-b4bc-7d8c6d78355e", "comment": "Malware payload (NanoCore)", "value": "c2f156ddeef8be85d38f8483656d9d657bf8f147657dfbb18b84a235c2bcada2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084777, "uuid": "9f66cb98-ca9f-4bf4-b082-4afec386ca3e", "comment": "Malware payload (NanoCore)", "value": "0a16121f6c9cf340574c7a31e811628449897186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084777, "uuid": "a4c9777f-bf2f-4f3c-b555-d62e1e014ff4", "comment": "Malware payload (NanoCore)", "value": "5dc0236101af0c7f91696d52ed92e9a6439293a1ef4f8800b527078dd6f78a486c2f1f5518b6589f09189fd6212bc9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084777, "uuid": "adfb93fb-0a9c-48cc-87e3-128df0ad1627", "value": "T15AC4232086979B2AEA7037F4247646D023B6B32EB5B5F7D83CA153EDDCA23550640F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084777, "uuid": "0797584b-7957-4cfa-987f-8c56580528f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084777, "uuid": "756f79f6-2e15-47e8-8f03-a653b44cf308", "value": "12288:eV2L2IrmYZ9nYRrIbcnXTaznVKcsWfOnVCBXqOP1vKlWbW:eV2QYXnYRUmTaznVKIkC9qO5K8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084777, "uuid": "3b19732f-2341-4cf1-95a3-a5f92baa2e05", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084777, "uuid": "ee56e40f-dff7-4663-aee2-ed9df437c5ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084777, "uuid": "041fea00-a9ba-474c-9739-38c725d2f7a8", "value": "2020574185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea16067-cf4a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652067752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067752, "uuid": "e1f7bb0f-8c1c-48de-9967-89e0e2b1ef02", "comment": "Malware payload", "value": "943fde4ec9a2c64e2802f5d7940ed0cf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067752, "uuid": "8598a6ac-5d10-468f-ba85-a7cd752d4677", "comment": "Malware payload", "value": "c310fa4a37776fd5a0a9b015d77606cdae9c2492620fee44fd45df088037f2cc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067752, "uuid": "a37bf53c-6b5b-41fa-afd4-5415bcc93859", "comment": "Malware payload", "value": "07a99a2cb9738429d55a4d46c7ff0a460308f980", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067752, "uuid": "5ec54160-5802-404f-a23f-bd55a5b0ce04", "comment": "Malware payload", "value": "7643349fd0b9f3068a65ceff37a520701641d13328302b0981a03f6e30b648394b854e8ea9f65c7fa450d06afe1ac3a5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067752, "uuid": "739fba37-b6b9-446f-a7d9-1b65e11615e1", "value": "T14FA396163F0A6133CB4D53396907D2D0A6F58D178AE1C2033162B1DC9D725DFAAAFAD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067752, "uuid": "33eed52a-5f3d-405e-a40f-4cd6089434bd", "value": "1536:Vlnjg5f3DXJLA4hogTCt4TlfIoGNl7BTYjP+0Yk/NJWIaVIZwDY9r+Agn2s:DoJLA4XXlfQgPGk/NJ1ZwDm+Agn2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652067752, "uuid": "cf07ba8d-f3e0-4da8-8d02-4adc9915bc62", "value": 103524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652067752, "uuid": "b9bd48f9-675c-40c3-9aa5-1b76bdcb9aff", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067752, "uuid": "9a1f50f7-25c7-4d2f-ac8e-91a5465ad716", "value": "js_plus_100_bytes.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca29e2c2-cf85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652093407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093407, "uuid": "e6f0b6a2-9133-4188-bf21-f76d3b20f1bf", "comment": "Malware payload (Mirai)", "value": "7239d793c2ab65196ed62a6d307f3c50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093407, "uuid": "65c26da4-7582-4926-b476-012cdd81188d", "comment": "Malware payload (Mirai)", "value": "c3e062214396388b20add49f6f54b77420d143c960318c44103df16ac46b47e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093407, "uuid": "4c8be7ff-4b72-4388-8c1b-7975fcf121f4", "comment": "Malware payload (Mirai)", "value": "410814bd1ecab270ad595176a15daa728a745e41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093407, "uuid": "5496f21f-620f-4904-8f7a-e2f59b065a68", "comment": "Malware payload (Mirai)", "value": "64c94d253aa578b8fbf97ea125dd3bb91cb0a304f66fd74317e867280385ea0fb2f5088b7e3129c6ec27a59d83cc8a8c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093407, "uuid": "9500dcd7-a06f-4e28-9f06-c8900b2e708f", "value": "T1A1832981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03A9F95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093407, "uuid": "a0e79109-0d7a-4dea-8155-c72ab102f685", "value": "1536:NySHwrZKkRozEsK3pU33eZtU5SWmZPeTriW/SnvL:NySQ9KoF83w9ZPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652093407, "uuid": "930d4793-8253-497d-bbde-5f68507da897", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652093407, "uuid": "ce70bd5f-b357-4468-b676-a656c62ca087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093407, "uuid": "79493070-94e8-481d-9004-0ae84c88c9f1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b884b198-cf6a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652081781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081781, "uuid": "a8203f97-b8b2-4462-97e3-0040c3676a14", "comment": "Malware payload (Loki)", "value": "7d9442e8f675a83353fbab0085010519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081781, "uuid": "d0f9d6e7-2aa5-493d-a654-694030d40411", "comment": "Malware payload (Loki)", "value": "c42be1caec1b7513141cdc37210ffb7ca87dcbf6c344bc0754374e29c904fdd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081781, "uuid": "a7fbe972-6e1d-477b-958e-73bcc852dceb", "comment": "Malware payload (Loki)", "value": "ffff85214ea86ad35e5cc4d245b915b9251923a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081781, "uuid": "ddf9e333-ac04-4647-ad70-d1990dc111c6", "comment": "Malware payload (Loki)", "value": "80f0ce10e9413c69492805ed6ebcd7b11201108ce5dedaadfd9b2aba5121be44a06a5b866003f8a4480fe8ebfe18012f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081781, "uuid": "41e57c46-4951-4e58-bdc3-abf39e681b68", "value": "T15694125966CCA761D03907FFA4B3150153B4AC236923E66C1CEA70EA1CB3B454F92FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081781, "uuid": "e3230fc2-22e7-4e17-8a1f-127e3047727f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081781, "uuid": "24bf9a5c-1951-49f7-bf3b-21e531f10ecf", "value": "12288:hfqgjByUhJXdR3bCFdjEMfamqaU8wdFEO:BvBVhJXdR32fjx1qaUbdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652081781, "uuid": "bb971ff9-5c31-45ab-8297-e3f1f7a1f785", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652081781, "uuid": "5343cff5-b515-4a3e-a941-425e8b2a7ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081781, "uuid": "5fd3c88b-414d-4f62-be0d-0a64917df87a", "value": "DHL_4755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065901a0-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652109828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109828, "uuid": "c1c3c484-6c9f-43b3-85c7-84198c568055", "comment": "Malware payload (Formbook)", "value": "00c6b5f2ec9e8cc5f4abe94835fdcf75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109828, "uuid": "7028082e-c9e4-48dc-b794-7a103d3a780c", "comment": "Malware payload (Formbook)", "value": "c5e5b0154f470fbe8df1473ca1ce5cc6949b709c2221dd66a21874b04f11d50a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109828, "uuid": "d0f4ce6c-b640-471e-878d-17d178d73377", "comment": "Malware payload (Formbook)", "value": "f63e6a56616c27a4ff94063451000e165a8b7ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109828, "uuid": "19e2a727-3f11-497a-8bcd-9108f57d30ba", "comment": "Malware payload (Formbook)", "value": "d63aafdcd6a90d224aa73ff085da3568206a40fdf980f1a09eb0f65280b8039be69d31c96233152c1fb4e87f42548062", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109828, "uuid": "33c086cc-6d36-42e4-91ad-135188509de0", "value": "T13C2412153390D09BF45396361B3D136AABF9A21314A9864F33247F8E7836AC0ED4977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109828, "uuid": "f70c1ee6-5ba4-4c26-9786-d613b0208608", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109828, "uuid": "aa01676d-cfc8-4404-9540-fb14b4e4fa43", "value": "6144:HNeZmz5+zFs5GJMA5FdtNk4Z1pPRXw3yXWKaqjrA12p/:HNlz50i5GiAPXRXwCXaBc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109828, "uuid": "c1f8747a-c853-4efe-a071-4b1d7fbc15a1", "value": 229831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109828, "uuid": "d3510904-1202-482c-a67c-a4f01d8e5c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109828, "uuid": "576ef007-099c-448d-a54d-b465868d9749", "value": "00c6b5f2ec9e8cc5f4abe94835fdcf75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1a7d0c-cfa3-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652106186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106186, "uuid": "fecdccf2-84c7-450e-b790-70b17df11c8d", "comment": "Malware payload (SnakeKeylogger)", "value": "cf4e638042c5eae7d56476a5d014c7d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106186, "uuid": "f1e696dd-bcab-4340-80d6-ccd26120d441", "comment": "Malware payload (SnakeKeylogger)", "value": "c87e8d2f201fab1985505b25f2eb6a78880a10be371060f788a6615af34ae9e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106186, "uuid": "803a3a32-ef36-4a3a-a310-5713964194b0", "comment": "Malware payload (SnakeKeylogger)", "value": "fd2ace211f51d24be6ae9b4d114d2ac78c56e76e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106186, "uuid": "1e82dbdd-855a-4831-974c-d604e134f041", "comment": "Malware payload (SnakeKeylogger)", "value": "5f8d6a1a4f0a355c8d220d23178b1b6710cc95bd06ea67bf7e379ac4cb43fe556b8467170a171fee2e8b2e523129a666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106186, "uuid": "6d656bb9-9baf-4b1d-9e99-6ac3729655a5", "value": "T1F4A438ACB12035DEF85BD072C9682C64A691676B431F42039433E3A99E6D6F3CF55CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106186, "uuid": "6de6ff52-acfe-454c-88ef-1e7e0eb2193c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106186, "uuid": "f51c109b-4beb-4fb7-a156-830183b96be4", "value": "12288:7gjj33mQpZOiDV6xehlzJGC37ZysGF+EWHnwi6m:7gjjnm0Oixy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106186, "uuid": "d032519f-ce22-4ee5-9b24-f195b00eff2f", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106186, "uuid": "706411a2-d14a-4436-b7e3-1440f58531b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106186, "uuid": "8966a14d-9f07-45ed-8aed-129c54f444d3", "value": "Payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64d5c49-cfd9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1652129424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129424, "uuid": "35e41e7b-e783-42b4-b964-292476b74323", "comment": "Malware payload (Gh0stRAT)", "value": "a824640862ea34979abb4d80f2ee07b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129424, "uuid": "96102006-e7ba-459f-bc3c-8c4509b070bd", "comment": "Malware payload (Gh0stRAT)", "value": "ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129424, "uuid": "28da1498-ce60-4248-94c0-8e1fedb146be", "comment": "Malware payload (Gh0stRAT)", "value": "529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129424, "uuid": "fd552e74-853a-4843-8b63-33a8bf9545d0", "comment": "Malware payload (Gh0stRAT)", "value": "6be1df079eb3bf244a17b5fb7d7b20450b2b82c01bfd71c7cf383c41fb6a97854c6ecc2f13eca0981b4d61bceff04857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129424, "uuid": "ad6f9a30-625f-4fc1-b202-4206c5538ba8", "value": "T162249D52F385080ADE59263E4796993D1EF3EE3196D94D8B376DB8E8023D708D9CE306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129424, "uuid": "c978f4fa-cceb-4d7b-bd1e-4ffe32de7029", "value": "e8991ea26876294a9f794f7280e55d6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129424, "uuid": "8a9a1ff3-6f6f-412a-b12a-a45475ed3e1d", "value": "3072:J/9jNNTRr4bTYBCTZONEI1u3HO+cQh135J7WOwbAMt9+pCkSAkea3vujn4vUFLGR:71r4CEI4e2JJKbB7ZA9af6n4MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652129424, "uuid": "04998200-83e5-4945-9f36-ceb8aa6437a6", "value": 221277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652129424, "uuid": "78cb5091-8709-427d-ad7e-7c0c3e3fdf4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129424, "uuid": "a2fd4acf-5e0b-4953-8487-7442d008988d", "value": "589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a253f9b-cfda-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652129699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129699, "uuid": "49ba29af-6633-4ea0-9662-786c2e6406d8", "comment": "Malware payload (Mirai)", "value": "4fb50af90733ce7f55ec383055023217", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129699, "uuid": "b01496b0-e45d-4421-8324-72486a4f46f0", "comment": "Malware payload (Mirai)", "value": "ca7d228547d1d43871a87bfe2ac7e629fc03cea36ef0af993219d3a9256e1e9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129699, "uuid": "b35748ad-b121-4448-895c-80d58819b87c", "comment": "Malware payload (Mirai)", "value": "7d3bce79e4d9e896299cb139fa9f360c25fa8faa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129699, "uuid": "3ed88e9f-1bfe-4f52-8ee8-152f87e0d8a7", "comment": "Malware payload (Mirai)", "value": "4d2df9324ce29549fae735a7fea844ac52373e5da0db0ca9b4fc90510dde3c2b12658f1d7077b67ba0906314b4c4cf3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129699, "uuid": "f5ed4c55-f82f-491f-9b08-f804347aacd1", "value": "T1E4C2D024270FA535D3E00078C9A0C39565AF176CD1DFF6267D540E2CBA6590E61F9E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129699, "uuid": "098cbe6d-beb2-4a84-9b53-bf53f78e5de6", "value": "384:qdoc751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HAG4IEhymdGUop5h5r:qn75KMu5z6sOj4qyDs3Uoznr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652129699, "uuid": "15151e9a-ad45-4d13-a887-303b34bc383d", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652129699, "uuid": "f314b577-27df-4b27-b099-90818f67f2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129699, "uuid": "8e9d6b9d-93ec-4560-8956-251468b28f3e", "value": "4fb50af90733ce7f55ec383055023217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c932e6e4-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652105001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105001, "uuid": "91bb3d4f-aa56-4abd-b82d-b13f0e92bd47", "comment": "Malware payload (AsyncRAT)", "value": "935c4658e1549a3252110dd38698aae5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105001, "uuid": "d3eb42e5-8a99-48a0-bddb-9543b06dff14", "comment": "Malware payload (AsyncRAT)", "value": "ccc15c16d29cf98d5d9b20f3ab7e7fc1b6d14312112e5a71febe3ef12a7429e3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105001, "uuid": "9df54a52-b8d9-40b1-8e80-61bd901c37ba", "comment": "Malware payload (AsyncRAT)", "value": "a0eecc3620360ea7d291b54833c405d094d688bd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105001, "uuid": "f0380dea-74be-4094-be7a-89497efb4057", "comment": "Malware payload (AsyncRAT)", "value": "3520667a7553132f30cc357f2069a0d3c754779cad9b813933110debbdae4fbdca7f364d57a8726862e200983bd99116", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105001, "uuid": "7721e7d9-2d1b-404f-836a-4853bb724482", "value": "T1AF2412ECFB7872BAFC681BB0E31ECA207726FD7C40E3915BD151B58EB8784199195428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105001, "uuid": "fcdbbaf4-0731-4a7c-8420-e7699fa64882", "value": "3072:pwqCI0kSp0tIAQMyP87Ccj0GMfSVHdpKXTL3wPeWptDxB81Qo274GJ47GMI3HWdU:FCI0R0OAa84lfs94XGtDs13MubRnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105001, "uuid": "83447ba5-4010-4f3d-81c9-850e49171529", "value": 211624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105001, "uuid": "1d2dcc1a-61ee-4101-8830-a72b84a8dac9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105001, "uuid": "ab5fb716-9092-42ac-b6fe-7e837cbe0a41", "value": "PO-556MM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90cc5bf-cf48-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652067152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067152, "uuid": "bc573dab-96d4-47f2-99c9-458c1f4cdbd0", "comment": "Malware payload (AgentTesla)", "value": "407ee9a0a63bc9b0abe4ed35c2cea271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067152, "uuid": "67b70631-e886-48f0-8f5a-2efae94bff5a", "comment": "Malware payload (AgentTesla)", "value": "cdd59ab5b482a9dc7c389ae1fd2530449ff84972315d820524d11f8146c2cc8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067152, "uuid": "1b163bbd-7ed2-4c2c-b9df-26b32d597d8c", "comment": "Malware payload (AgentTesla)", "value": "cba00d10e4390aa5a3427dd5f71749fbf3c9ed92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652067152, "uuid": "11f1c74f-56be-445c-a2be-0d07b8524ddd", "comment": "Malware payload (AgentTesla)", "value": "8293da04657dbd5a66ab2f3d1f3c88d2d9aec17c763590090688210ff9a0071115b6e89ab503633a47258a7ece832c9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067152, "uuid": "5b1cd070-e9d9-4502-b5aa-1c3badea2524", "value": "T177350110E708AB6AE52855F2506A2AD821A10F46D45C0ADE7DF2FF6E32737D11726CCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067152, "uuid": "97c9309b-7c97-4495-a843-a92910f90cc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067152, "uuid": "64a3e1e8-0435-44c1-b5af-a099327d4c0a", "value": "12288:b86lJlWAk5VxyRtyG4PWAAqhCSeYZLVYKTbI8SeN6RZKqtKXwHKtvP:NoXIoHZpYKfIBA6LFqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652067152, "uuid": "98391faf-3764-461f-bfb1-cc92649ded4e", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652067152, "uuid": "3bb34acc-aa37-4512-aa4a-e1db35295f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652067152, "uuid": "aa4d3e23-b2ae-4aaa-802f-c61d829943ad", "value": "SecuriteInfo.com.Variant.Strictor.272386.875.9722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d323644-cfbc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652116739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116739, "uuid": "7ed58654-2f1f-46e1-8616-52a222225259", "comment": "Malware payload", "value": "b948b8a032d9742724a38cc1ec69f28a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116739, "uuid": "9540e5c6-3288-4e44-b624-2c7fd507e099", "comment": "Malware payload", "value": "cf69a60209794e3d89c956d1c77261e540d9874c397e7ca9345f49988f1cea08", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116739, "uuid": "42fa24e6-fa34-40da-bf7c-a20b4e8a9e37", "comment": "Malware payload", "value": "1fc331dd2bc11af367612537847bba1f0c8d3fb9", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116739, "uuid": "41992410-257a-4532-9fb9-875496c86c2e", "comment": "Malware payload", "value": "586d584249abd0b5517c522bad39b724e106fcfd5d6e43e3a44f352290cbc26da9eb40a059515a1318a27460e1821fdf", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116739, "uuid": "33232539-e4ee-4e9b-9641-a3690a5a6b9f", "value": "T199B5E8CC63255628F1840D6CBC70599DFFDC28FEBC2CAAE6C54725B664EAF5D1829C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116739, "uuid": "f8d20d06-299e-490a-a9d3-53d5f823b2d9", "value": "3072:rWzBJbjHUmBC4PfFfY192U8pnHV7B8fnHQF741Em30JwcHfNPWnBxYeNDCERcg29:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652116739, "uuid": "df4ac7e2-ef7c-419d-8c34-d9c0ced6ab20", "value": 2268810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652116739, "uuid": "7dc86359-d53e-437c-8ba9-d7cb194b7fc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116739, "uuid": "98385a49-2d4a-4229-a5a2-e29f227d565f", "value": "Encrypted Client OG.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ce9c32-cfa4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652106474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106474, "uuid": "a6caadea-bf28-4ca8-97a5-a1f7e76dc568", "comment": "Malware payload", "value": "2ea234cbb34ed5185dde410c81e80ce0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106474, "uuid": "fd794f7b-29cb-4963-8d6b-dc6faced6f09", "comment": "Malware payload", "value": "cf70e1b1ab7980db737958b6308f2dd268b6f9b2dc18b4829d4eb32c99b8a3fb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106474, "uuid": "ebe0be01-f531-4a5c-8860-90b93e0a7631", "comment": "Malware payload", "value": "0230887b9cd33a176cee26eabcef46288f595b8f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106474, "uuid": "4286ab2f-b663-4d3f-b49f-ab802b3b90ee", "comment": "Malware payload", "value": "9ae19b86c12818392867c7d150e37a87b0d14bcab55318ba2605a5e67146f0b38a202de8b35ff2691131ba3ba0271f7b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106474, "uuid": "0b5daa39-bb34-4f07-af28-3f6e33e6913c", "value": "T1540432B8157CAB8FF5229A33D81E0786128380F247EAF5ECDB94DE05C6AB1657C5B434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106474, "uuid": "0caac778-e662-4831-a904-d8074dc0d343", "value": "3072:D/l68nODs+VNCeiofXuGsmK+Z4LaQjcDbGNw4l:jo8nb6RioPuGsd+uLaQQDbGNw4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106474, "uuid": "6ea30fa6-d5d4-489d-89fa-99b448ef564d", "value": 186612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106474, "uuid": "375d03c8-3e59-48b7-bca1-9348b5851f8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106474, "uuid": "16cbf107-8dd1-4127-b557-201c71b91679", "value": "Lath6-927482384783.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cc76f9-cf3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652062979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652062979, "uuid": "6d5b4fd5-19f5-4ded-986e-f1d1733be83d", "comment": "Malware payload (AgentTesla)", "value": "62cc5b3f5a95ab5273cd49655deee00a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652062979, "uuid": "a7b2a651-0d38-4bee-b230-560e6a357d3f", "comment": "Malware payload (AgentTesla)", "value": "d12492d39f91e9017749be2716d84853e5d3b025994dae3b0dfef7610a966731", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652062979, "uuid": "7f22d15a-0667-4e16-a4ad-d87edb0b8716", "comment": "Malware payload (AgentTesla)", "value": "d1995e382a55b2a5aafcb539ca04b0fe2c8b56a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652062979, "uuid": "f8fbeca4-c354-4b8d-b0e5-28a4abd072ec", "comment": "Malware payload (AgentTesla)", "value": "da2545ff8fab9f45a0df0bb5223002edae394fe64b62d757367eaae5cb81813f253524c6a8b54942cc56f40c0b98b554", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652062979, "uuid": "6ec1fb09-0b83-492e-b940-ed1d7014bb12", "value": "T10F25D062BD1C6467CCCBE5394064B7049015B7CE7B1BDA8536F2352F2AB3BC12E91D2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652062979, "uuid": "867e4cf8-9cff-4710-b331-0f8d8d831b25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652062979, "uuid": "99e67de8-dc75-40fd-bc58-e6bb6da6a8a6", "value": "24576:bKgjjG+XpcmVw50/ikEALwRJ5PoiGwmvkSQJ:TLZcmVwdl+wZPcdMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652062979, "uuid": "f9ab215e-26f2-4426-8463-36e7feafa870", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652062979, "uuid": "11463d11-e1d7-48ee-84d7-044c9f16302b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652062979, "uuid": "27beb5fb-0192-4596-abcd-307ded434c9f", "value": "Payment Details xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db23897e-cfda-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652129942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129942, "uuid": "60660cb7-975f-4647-8ed9-3ed395408162", "comment": "Malware payload", "value": "9a53784de5f4d871d93868f0879fa1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129942, "uuid": "21088cbd-5d5a-4eba-b86c-37257efaac10", "comment": "Malware payload", "value": "d447b892b3a86c24049ef7d69b92bf8ae770eb661fe8b02b168ef86f95339068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129942, "uuid": "f521e782-ad08-4fc6-8562-889767d39321", "comment": "Malware payload", "value": "574430777fea6d16a187d1045af845bc44da3ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129942, "uuid": "f25ceed2-0547-4bff-a24a-391877b65ddd", "comment": "Malware payload", "value": "ee6fc3e2615b10556774f54344e2e95abb2036967f415bca9970dac0a2265f08ee3ebbae06e868e024ee82effb3bf9af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129942, "uuid": "c5ea97fe-96aa-4df0-8fa7-525b3239b4c1", "value": "T1D4558D978341531EE382703581DC9E35B60A56312A2F7CA76B051BBADB3B3C06974F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129942, "uuid": "ac0f1f26-0c65-490e-9a29-34db81769631", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129942, "uuid": "d8603972-2f4c-422d-a908-191cb440d53e", "value": "24576:epE1HzrN0gOJtzMoCenXFeqUDe6Okv2wY9dcjLgD5g6/AY7eYF3BgBvg5oUiKju:e2zrN0gOXzFXFeqUDfOCYAjo9IY7eYF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652129942, "uuid": "cf74d161-9a33-49a5-931c-523a498bf941", "value": 1319392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652129942, "uuid": "0d93d32c-469d-46be-972c-ee9560b962c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129942, "uuid": "0f2ffc5d-3cb6-41dd-adeb-5a1ce16e7f80", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a01a48a-cfbd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117297, "uuid": "1cd09338-6be2-4f24-8f77-6d18f4e41016", "comment": "Malware payload", "value": "03d8fd668ffafc3bc6952841068d7c32", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117297, "uuid": "b34bd4a7-3a38-4933-a124-dfc6adc7f5fc", "comment": "Malware payload", "value": "d5d697a79b034467535f0acbba7d34ea2f3060e608678286e9797cbdf3a8ffea", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117297, "uuid": "e2a16f5e-afd2-4bf1-bb70-abe95f053bb9", "comment": "Malware payload", "value": "3f08afcad94b3bac7e4205de66199c64daea9f2e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117297, "uuid": "dbe1db3d-4cce-44b2-bbee-0bb1a3aaa69b", "comment": "Malware payload", "value": "daab715a8f1e0e6f2026e56df9a5225f63e9133f7c7149cdcdeb4f3c3aabd1df3047bc9a2c69c36cc1b2cf6e040f6787", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117297, "uuid": "45a64c9c-68cb-4a6c-837f-8e863f0a9c7a", "value": "T16B72DD4D32BF25588523C95DC716897DEC91109D9DE7C0F0B384BAB93828507FB9B26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117297, "uuid": "7949d529-ada8-42e8-820e-52b1e520fcc7", "value": "96:f8MENm9oW6XPha4UYkT902+EYz2pk2GrjcjYARRJy+xHrm4JWCj0wYRmvR0YYGS6:f5QW+hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117297, "uuid": "1dd36e91-84d6-4a6a-bf18-2d346bd9535d", "value": 16067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117297, "uuid": "bea79af2-270c-4b28-93c9-6a434f8f4d31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117297, "uuid": "5b28cb9b-8f3b-4885-9de2-ebb0aa969017", "value": "Protected.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a98d23-cf8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652097135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097135, "uuid": "bdf353e4-2c12-404a-9dcf-a4278b3665d6", "comment": "Malware payload (NetWire)", "value": "2abc561aa5e054d4d334fccd04e113a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097135, "uuid": "d840babc-5d95-4d7e-bb7f-8f3a56b69ee9", "comment": "Malware payload (NetWire)", "value": "d6819264b5b21ac60237b3625ae895f8adbdcd46550d1c7cce869d76bf462e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097135, "uuid": "9aa0d8bb-d0f1-4116-9e0f-3832ffd27677", "comment": "Malware payload (NetWire)", "value": "69f19a4e37bd7e3cdf51aac7f7b29890137a1451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652097135, "uuid": "f2f024ce-39f2-4d89-9b31-4660c0bf0d23", "comment": "Malware payload (NetWire)", "value": "7137917bd28730920fdfea4d029f38354e03e879f53bf7a1b403c43439c93a877fc00fc487e945cc73f1efbd921757b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097135, "uuid": "e6326813-185b-4c06-ace1-96f6b9717e72", "value": "T195E4124D726A9AB7CA7E36FC465642CA03B69578B041F7C57CC961EA02D2BCC0E127D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097135, "uuid": "8370176b-c2ee-4b55-bfb1-5d0722c9f52b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097135, "uuid": "8c8494cb-01b9-486e-9206-cd2362226643", "value": "12288:++2L2I1cwFtGyE7k1EhiLMigaogIJVvGhBAX7NyWRbAtSsqvjzE:n2PcuGjQUigP1QSqOjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652097135, "uuid": "b873243a-1e91-4e06-8a64-07537efe8fa0", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652097135, "uuid": "822376e1-3c37-4613-8768-32fea9a320e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652097135, "uuid": "8e6cde73-a6ce-4418-9f5e-a2866fffa03c", "value": "gold.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12511daf-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130894, "uuid": "c75e52d3-ae4a-48b8-820c-1cf95a73eaf1", "comment": "Malware payload (Mirai)", "value": "1309b98a4382b46b2f1b89f16dd4bbaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130894, "uuid": "cf17085c-ea87-4404-9aef-c1b96b6e2ac0", "comment": "Malware payload (Mirai)", "value": "d6e52d3a63bc3b096dcb61038db9e275b576090d5f20cd078a127fde7f30f7a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130894, "uuid": "23ee2279-548d-4c9d-bfec-261376ac63f4", "comment": "Malware payload (Mirai)", "value": "f59d32216171b52d3f5000a50c0f7c2c2016c75d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130894, "uuid": "d16895a4-ee05-4169-85c6-697275aeb127", "comment": "Malware payload (Mirai)", "value": "e51a6c2a7a3278edfe89277f395b2dee2675f77678ca85d7d9466895b6248c9abb67bf03b2c18976c261b60a7123ee7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130894, "uuid": "2b23a175-0bcb-42d2-914c-f0adefc198a7", "value": "T160539DA5C4B8BD99CF69927CB61488389723900565A33DFAE742C796D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130894, "uuid": "bc85ecb3-fbe9-4f65-a66c-4bead15cefab", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC1V2:BjiBGhGp+XZxtf+d21UYjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130894, "uuid": "f0507bfc-faa4-4e57-b4a3-54164249394d", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130894, "uuid": "2f15e8f4-126c-405d-b791-041866940936", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130894, "uuid": "b13ce861-00db-4a14-bc84-40f900468457", "value": "1309b98a4382b46b2f1b89f16dd4bbaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b6d7df-cf5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652076602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076602, "uuid": "f5e8bc1d-023d-41b5-8e17-5d3918f52b84", "comment": "Malware payload (AgentTesla)", "value": "f8813469618b913b16d589d8387af261", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076602, "uuid": "bf5187fb-47df-4f90-88f8-71e347b6dca8", "comment": "Malware payload (AgentTesla)", "value": "d72d9e52096e076a6db5f05f317e7205f74f75dddd75e21dbe1b1b434c2bdfc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076602, "uuid": "7d8f18d5-64d7-4499-ac07-bd4c0562f3ed", "comment": "Malware payload (AgentTesla)", "value": "646f5fb956160be263f9c903165ef635c5a2d8e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652076602, "uuid": "ba721d50-139c-4535-a729-a436b6d8e504", "comment": "Malware payload (AgentTesla)", "value": "7a34c15fe92e50f2655b39567e0137059cf47dad70c80d9d47e81543a66e59afa907814388f8f6854851e7269f12df24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076602, "uuid": "ab1cea2e-cc2f-4af1-9208-cf75e5975722", "value": "T14405BE98351C758EC867C9318A968C74A75368AF671B513392A339BFB90CB47DF130B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076602, "uuid": "e11e88d7-8c91-4454-be9d-a6d7068b1e39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076602, "uuid": "1cb23d66-0050-4112-b371-ecaff589aa4b", "value": "12288:cLTiuYdbsrp0eO24ktI2Rw+ScZNVK7D08OX4l63/STD62BZkOTfmcz9kE+teD/ji:cgbsy37zgw+ScZNVK8X4lW/SP1n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652076602, "uuid": "482e21dc-d57f-4e99-9063-14f7180d4b06", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652076602, "uuid": "58b8e5a9-7054-43d0-9c6a-151285078610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652076602, "uuid": "0ff48859-de31-415a-82ad-e9b17ec95149", "value": "SalesXContract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec61eed-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130915, "uuid": "5b8ba9d0-7aaa-48e5-814a-310418f01178", "comment": "Malware payload (Mirai)", "value": "2c51ab34e3f7ff714d9a86e9dca568eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130915, "uuid": "c8eb075f-36d8-4cef-92c9-9ac698168e88", "comment": "Malware payload (Mirai)", "value": "d7397cd12ec2097c85e3e8cf392ef2c7ffb08ab547a836f932270a47784cde00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130915, "uuid": "eb880634-9a35-47c0-9c95-3687798d7025", "comment": "Malware payload (Mirai)", "value": "978490b3cc89190938afd8ef5e56a886413d9ec8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130915, "uuid": "534385fa-da70-47a3-89b0-f8b62607e7cc", "comment": "Malware payload (Mirai)", "value": "6e9c227c94e1346b6659e30e23ea41fd0e56fa4f82461c8630fae5fd418ba2e6f571025bbe945077ac76894877df9678", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130915, "uuid": "33c34c95-fb44-469a-a5b7-1adf211cae55", "value": "T156330756B8818F05C5D512BABA1E018E33135768E3DFB3239E146F606BCB92B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130915, "uuid": "915f24fc-2f61-4497-aa40-22718d432f1d", "value": "1536:Z8n9zF1owVC7R6cTQqX1hIPzMIDix2HDDRli:o1hVAvXPCHDDRli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130915, "uuid": "e0b2d172-847d-42bb-84c6-0f33b7bbe6c7", "value": 52236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130915, "uuid": "3aa9511d-559a-4812-9aaa-f17092d2071a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130915, "uuid": "33b8ee4f-7d7f-4320-a24d-73a5c5876645", "value": "2c51ab34e3f7ff714d9a86e9dca568eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5637df-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652107312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107312, "uuid": "6a74c148-6576-4bf5-ac8a-d1b66ee85572", "comment": "Malware payload (Mirai)", "value": "b7a8ea909d428adb86b4a6d626ee1207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107312, "uuid": "4f372374-e104-4db6-8b76-bb8b0062afc5", "comment": "Malware payload (Mirai)", "value": "d74d3927efa62c907ee8bf6d87450b44cbdbcc78d9d015cf70ee639c08b5514e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107312, "uuid": "43cef0d2-1e06-4637-97dc-6e334077163f", "comment": "Malware payload (Mirai)", "value": "425daf7dcfd7c20d8408f09031490b4eb00712bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107312, "uuid": "aa0f474b-c90f-4360-97ef-c3becd381a36", "comment": "Malware payload (Mirai)", "value": "54599e36bf6f36ec5f7963f52b5d93658ca2262e4ba837894c9fb30fe725dcf635470f75723494c9660750a5a3564e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107312, "uuid": "5600cc14-96ca-4f6b-91d9-52f1fdb81b54", "value": "T177337C65D46A9DACC1064AB47628CEB48B22E0C0D7473DF6A720C3A99053EDEF554FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107312, "uuid": "08d9306c-bc83-495c-9b2d-61a3dff02a14", "value": "1536:iaoQXD3e9iJyfs3owh1/q08zthypvNLOOlFslENC0/m3:ifQXo7f+oe1PFslg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107312, "uuid": "3a83579a-a3b1-4f71-b8f8-c87f5eacb98f", "value": 51664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107312, "uuid": "fcf1feeb-a274-42cb-be06-9d8871d3fbb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107312, "uuid": "2cc840de-4e83-4c53-9543-936addcc5eb8", "value": "b7a8ea909d428adb86b4a6d626ee1207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017c7a4e-cf4f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652069877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069877, "uuid": "79603be8-618a-4723-82b5-9aaad0157710", "comment": "Malware payload", "value": "9a80877f5f117283c62fec709745dfb6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069877, "uuid": "60af8b01-e97b-44ed-97a4-1d4fb4521445", "comment": "Malware payload", "value": "da032cb3dc7721e18630f1149e593d97f18144e6c003d4e3a07907757008330a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069877, "uuid": "de6ed88f-0279-4ab2-a40e-1e03254857f9", "comment": "Malware payload", "value": "c16206984165807b5e6b67afbd1cb3390d3f24c3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069877, "uuid": "77e23be1-c484-4108-8323-75094fde695f", "comment": "Malware payload", "value": "c2ec239942fb24b2a99e143a01c163ab7991cc6d90d4c15ba79606cd3d871fa6b348852a6968316ddafe20fbfa594853", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "discordstealer", "colour": "#34DBF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069877, "uuid": "bf8ba48b-8513-4f7f-9c54-bdb1cbded441", "value": "T1AC3733285793235BE78B25B473C29C7175DEFCF48F7111C1A2CE2551A620881EAAFA3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069877, "uuid": "fe2ce842-6563-4f4e-9256-5645c676733a", "value": "393216:HXb4m4nagRNg5rSA0092Go4R+am6z1yodrj5B4e6g4ZSbYDXoYFMAE2YQCJ:HXb4mAaWn7+2CNm6zgoNlB4FZ1XoYWHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652069877, "uuid": "3759c485-99d7-48bf-a933-ca95acfdb57c", "value": 22778156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652069877, "uuid": "5872ea34-f7d0-4236-b5b1-6eb58e7c12d9", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069877, "uuid": "e98945e5-4b6b-47ed-9799-73bd238ba8fa", "value": "8b7252c0568dde4408033110bee56d99ec603d51a1c2b4008a6643ee904154ad.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45430cdc-cf96-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652100485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100485, "uuid": "d908bc88-abff-4e9c-b589-6a372ee6853b", "comment": "Malware payload (Formbook)", "value": "5bdaeeded0643b6901448b5fc57246ab", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100485, "uuid": "ab5a7a26-65a9-4035-8ca4-45eae3b1af1a", "comment": "Malware payload (Formbook)", "value": "da1603347c0b5bf74d8e32d0a4f112d5fd5f10fa4b50dad769c9afaadd87cfe8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100485, "uuid": "0803d2f4-4666-46f3-a64f-27d499930e76", "comment": "Malware payload (Formbook)", "value": "2273972c7879a952d089e851c8c6c4766da23aa3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100485, "uuid": "76f740a4-680e-4d18-a4b2-9afe08b1d0c9", "comment": "Malware payload (Formbook)", "value": "0af2c95ce29497a925414c0828c7fdd5c13d7cc33cb33f39674cc1456f953b3983992f9e9c59a21c8e0aaa9e9940c6fd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652100485, "uuid": "efd99c73-b866-43ea-93a5-c4844ee39db7", "value": "T1C485FC31B132BA87C3161161565FBE86531CBE43B2C55F8CA04DFAF82CE68E79342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652100485, "uuid": "9b386792-22fe-433c-95ce-bcb49c143120", "value": "1536:7e3eTeNekeTeJevegegegegegegegegegefedepege+egere9ebevefeZeLe/e0l:dG0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652100485, "uuid": "663d077c-98b3-4a8b-bfb1-30bbd2c4323f", "value": 1739232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652100485, "uuid": "bfb698b8-7516-4f92-9301-0c2fcb7b9840", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652100485, "uuid": "2ef2dd44-e765-413b-a0a3-e9b9820f616b", "value": "Shiping Document.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9a09c5-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652104359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104359, "uuid": "faf26a33-4b03-4dd8-9b6c-6d441ba52010", "comment": "Malware payload", "value": "daf3f48883697f2fd1123c536d4dc50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104359, "uuid": "86f09af1-d730-420e-b7db-de0fa4e0b937", "comment": "Malware payload", "value": "dad6311f96df65f40d9599c84907bae98306f902b1489b03768294b7678a5e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104359, "uuid": "b6b9104d-0d37-4203-b979-a60ea645530b", "comment": "Malware payload", "value": "0a27638492b57fa6363d44fe2346bb23cb7da507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104359, "uuid": "e665dc2d-5633-48be-b183-cff9b5fc3f26", "comment": "Malware payload", "value": "9b63bfab6f5bc939a311dbff1a0a0b8bb2de1405738a1a3d67d0409b1b7a59c7aa44d52187572654b7f49e0777b2928b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104359, "uuid": "3ab6e798-7d8c-486e-ba15-88fbe25ebe61", "value": "T1AA553D11A7A6DCABE2E26C314D675F9C9928ED06CDB6023B13A7771E1FB13C80D5E604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104359, "uuid": "2707a9eb-43ef-42c1-b491-6258d7b18ddf", "value": "22b3d76d5d68ffe304fe22f9c46e63ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104359, "uuid": "2dd8b71f-f736-4eed-8d1f-554664728464", "value": "12288:QXxYNEe5zGzo9DCYxcshUOQAylC4hkmalVtXLR7lc4cq:bNEe5K89CCcwU3AylCBFL3c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104359, "uuid": "5ba41750-3e46-47ba-8db2-7b9096589fc2", "value": 1366640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104359, "uuid": "0f08a6af-7a3b-4d5b-816c-9883eb12edd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104359, "uuid": "a086b4b2-ebec-4bd1-9712-b36d3ec6e02c", "value": "daf3f48883697f2fd1123c536d4dc50b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023bef3e-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652109822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109822, "uuid": "127508fa-7294-4fe3-871b-742f4163abf6", "comment": "Malware payload", "value": "b382176c6fa5171c9d8bba9957603553", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109822, "uuid": "3822c4cd-b8e6-4ef2-ad30-fee176b4be19", "comment": "Malware payload", "value": "db514de06dda689baccf5d892b2f0c42f533067e84e160a57c58975db1a80e8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109822, "uuid": "c0ec88a9-14ae-4cd9-983b-bde2803b5167", "comment": "Malware payload", "value": "800655b52a3a527674335d8062a7cbefb56357f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109822, "uuid": "db71d61a-112f-48a7-99d4-c2b15883a0c9", "comment": "Malware payload", "value": "cf13be0e3fb5834f5e192a13982a42edacbfc6da03a0153ba850f5f30f4cf33c8b406cd8d3ad2a1df2c443237910652e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109822, "uuid": "1838a4c9-62a5-4d0e-b583-bcfd48cfa97f", "value": "T1D4B48B212A2CAF10D53ADB751983C13143F3A84EBA22E13ABED77DBF3555B01C663625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109822, "uuid": "fa4e5bc3-8fdd-4ed9-854d-d71a39b77a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109822, "uuid": "396112ee-a6c8-4fd4-8cce-95c06613fe1b", "value": "6144:AlTozY7Ip/zQkKb2WKkPynF79aCU7KcL5RjmYkT+MrgM2KH3LIRgMXs2RSPc9TJ7:fzqBejg71dmYk5rgwH3L27SPc9TJh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109822, "uuid": "1cddbac7-fda6-4375-87ae-fb717606385b", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109822, "uuid": "26b13816-c137-4445-a7c7-de745ff90674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109822, "uuid": "974e4e7c-4c66-4894-93e3-e81e313ba291", "value": "b382176c6fa5171c9d8bba9957603553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5231a1-cfa8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652108334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108334, "uuid": "4c50949b-b3e0-43f5-b7b7-4e3b624c4055", "comment": "Malware payload (Mirai)", "value": "385d5b64c31b0f1291a0b275b40a3477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108334, "uuid": "87fb6d46-af5b-4662-b962-dd239b5bec4b", "comment": "Malware payload (Mirai)", "value": "dca85b9c164f3f088a2c5181762d4ad1991a3ff2ae16041c29466cac076a0ff5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108334, "uuid": "d962dd92-539d-496c-b9b4-e0d962c3184a", "comment": "Malware payload (Mirai)", "value": "4b4d6c1f98cacaaa93759ed7fd5a66d09487d77f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652108334, "uuid": "43cf9fad-220f-45b6-b879-bbe9a2525593", "comment": "Malware payload (Mirai)", "value": "aecb3d03174eccb975f8d932efd4513aeaeea64ecae0f820f50b7f4e18f7686ab89a592097114fadc09980d8b128d89b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108334, "uuid": "18cab749-c467-45e7-a5f0-919b9f177579", "value": "T1F5531925BD751A26C0D4A17A21FB8705FAF6138E22B4851E3DB20E9EFF507406513BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108334, "uuid": "eb7a7774-d4de-44fc-9e36-e22f46d7f3bb", "value": "768:1Rotfc3BbKf35UIm4N6xN+406Wsh5ir1dnQdENSvIwBO+2x741lj:1RmfcRbKf35Ut3xNq6vhYRSxyqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652108334, "uuid": "e6afe43a-974c-4761-a574-e6509d76df56", "value": 61200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652108334, "uuid": "571f23a5-9149-4e98-b9d0-bb0b54899a01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652108334, "uuid": "74439777-494b-4248-9864-a5bf46fac79f", "value": "385d5b64c31b0f1291a0b275b40a3477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2fd369-cfe0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652132496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132496, "uuid": "55d1a3e5-9c8c-4240-bdee-d1bbff8346f4", "comment": "Malware payload (RedLineStealer)", "value": "ab3182a4bd2f477447a4070e3aad6ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132496, "uuid": "78bb11e9-f353-4f26-8eda-0cad6cf58cf3", "comment": "Malware payload (RedLineStealer)", "value": "dce00a42250dd43fb443a3b8707c618c419d3812a525d1f076f1a026aad3e75f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132496, "uuid": "ac301f2e-4274-4c7e-8473-bedcaffcc2ac", "comment": "Malware payload (RedLineStealer)", "value": "d04c657aa01ef662ac574589380a1a6908c8e2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652132496, "uuid": "2a19822b-8a5e-43d2-810a-847d39af28f7", "comment": "Malware payload (RedLineStealer)", "value": "cb404dd2b722ffbde4bb5e0a18a71416124d7a7eb9b340a8dd9e9f584f48cbcd49b53a4bffb2f3b5a4c74dd3f7eacd89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132496, "uuid": "86b9ada7-44c1-443f-911e-759da84e788c", "value": "T1A0B32A6C77DC5624E5FF8E7078B151D146F0F1A26C02D79F4EC5B4AA0A22B80FA52BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132496, "uuid": "055f976e-9ccb-4f11-8f55-a543e6a2b791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132496, "uuid": "70b4fa98-24a9-48cf-93b4-18f78ae780a6", "value": "1536:nRxCkCrPQ2IRAXcGc5vCCtt8xs+Tp1EFNrfcH/QMUpunbuZNoxsrLA/0wuei69L0:VCrPQwQ3V4p1GNrfcHUpI63A/hTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652132496, "uuid": "d6803e22-e949-49c4-85d8-238f10ce1d57", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652132496, "uuid": "207a272c-ef03-4c74-9c83-e83b125e02c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652132496, "uuid": "f30df22c-d4ce-4630-862c-9910b9af0518", "value": "ab3182a4bd2f477447a4070e3aad6ac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfbd389-cfe7-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652135341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652135341, "uuid": "59e73e52-21ad-4a8d-87c9-66ece3cf6fac", "comment": "Malware payload", "value": "1bf1b43da7af2742454d023676b4d5f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652135341, "uuid": "0a619149-d069-47f9-986d-b56d74cb0ba1", "comment": "Malware payload", "value": "ddc26c8cabf13b325a4fb7bf2c0c937e0e86f3ada16b9bd8ff1eb4f4fe1593f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652135341, "uuid": "f98d4bb2-4789-4cac-ad8b-2d3202fbe014", "comment": "Malware payload", "value": "2b412ace8310e5ce93b6c39ecbd44b870f780426", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652135341, "uuid": "e5282297-2999-48b1-bf97-6a92133ab182", "comment": "Malware payload", "value": "b560a4bf48739fbfc9c0306de7bd9ed3851f62c8a2e527717fd1f98469072c3b589022ca77a9fab38113d22ccf2bfc6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652135341, "uuid": "d02d9872-5a61-47eb-bd9a-24fb8ca61564", "value": "T14F84CF04BB90D035F1BB22F44975876CBA3DBEA19B2441CB62D43AEE56352E1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652135341, "uuid": "53f4f2b1-d651-4406-88d6-b47a3e86b88f", "value": "0e0410a15e7632599c99648ea781db9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652135341, "uuid": "213879ea-f1e3-4e81-acf1-ea92ecb2f85b", "value": "6144:lGeJWM0xqxXsBDOhc05m25OaOXYXCOTyTFb/X8lbO6VC776rKv8OR4kP1/o:sHDs9sBOhV5LOahSOuTFb/MlRCP7RrP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652135341, "uuid": "799cf222-23c0-4881-9cdd-c47c76cbd07d", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652135341, "uuid": "f72646ab-1937-41cd-bd0c-07fc447cae65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652135341, "uuid": "dea6c0c0-c236-480c-8ad0-c8fdc2dc4dad", "value": "1bf1b43da7af2742454d023676b4d5f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778da843-cfc0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652118608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "81014d02-b942-4559-9e6b-8a593067607f", "comment": "Malware payload", "value": "73a42396e3e180c25419cf6032aedc0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "331e11be-d035-4d2a-9088-b8e80900b261", "comment": "Malware payload", "value": "ddd52471a62378e43f936bad771468cf95934b3df21bcf47f9de5dd913dce541", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "32ee41b0-504b-4909-821c-1e91f1afc39d", "comment": "Malware payload", "value": "95270ee8bfb2d4700872c39d42ebda6063551f07", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118608, "uuid": "0c028889-b721-4e30-bbca-88cb95501a50", "comment": "Malware payload", "value": "7592238d90c9cf0b5847f6faccd8f923b11ac95e7b270c790f7bdeb56063b7a8c3a10b28ef1239b75d9cfdcfe33ea85a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "8f14d46c-04f2-407e-82f4-3cdfbabc8bce", "value": "T1D953F682BC50A629C7C04777EE6F509E3311ABDDD0EA3746DC150BA47A9E80F0D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "6712d75b-d745-4695-b5d2-6e2f70884c80", "value": "768:qNpSX4ltGcabf8u0GnP7+2xrh6RDFuYso1Jcy0uiDz701T1fj7NSqtUut65aQ8Mf:WSXGOfeGnTBxr64Y/cB8t464qbJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118608, "uuid": "b9198dfd-a65b-4619-b166-a587888de2d4", "value": 61196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118608, "uuid": "4a840ca3-121a-48ff-a439-3d75a2f310f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118608, "uuid": "8563d5ce-7372-4e0a-bdf4-39cf5c1a422c", "value": "1isequal9.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1863cd-cfdb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652130397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130397, "uuid": "f42a6a88-64b8-4712-a51f-4364c37ca75f", "comment": "Malware payload", "value": "2500ec467ff51e3fa1f0bec71c419372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130397, "uuid": "e78dcee0-3414-4319-aef2-a3a46087029f", "comment": "Malware payload", "value": "de115955f1e0ff59c5ff3a388f81185b0873af4573f354f2972938b6366ab6ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130397, "uuid": "46beb354-7519-4585-abb4-2ddb042ec821", "comment": "Malware payload", "value": "047542e3c35dd8e3775a70c08ac0243ee394adb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130397, "uuid": "f11958a8-1f95-4634-950b-f3e0f8cc5701", "comment": "Malware payload", "value": "d165786a3293477c14affb8259314599f45d2cf3e6070d44cd0bad8c018f1c8ef0fe215f226b3516e1b70d6f60f7b52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130397, "uuid": "cdbd98be-32c1-4d62-b2bb-e34fc3a1c909", "value": "T1D516333D7BCD9C1FCB99037EE49302A48EB2A4C13D83C7D2D4A77A7906526C2A85954F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130397, "uuid": "fbe63c49-9ae9-4c7a-a617-a8a1a97bcda9", "value": "98304:XL86uvLeXTc+7+1ZDrHbuOhO4tK2kRxd19qNt7o:XevLeX9SrTucQdWNt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130397, "uuid": "b61e06dc-04a9-4482-8346-f2d9863eeec4", "value": 4305408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130397, "uuid": "39b97a85-1b06-41a8-8195-d23bb7af9bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130397, "uuid": "de0366db-c7ed-42d9-8684-366e1f0a93ff", "value": "fdsfsd.vmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5314a7bc-cf95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652100079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100079, "uuid": "e75e2827-8cea-47a6-a3df-6cf7093aadba", "comment": "Malware payload (Formbook)", "value": "881b9f84ea0f643a24ae6589f0ff94ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100079, "uuid": "b15b0d13-8767-4d02-afdf-4b8b13d6424e", "comment": "Malware payload (Formbook)", "value": "de4f5d7be84c3a10afa75bd2463a7c2958afc54300f88962f8e069d121752796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100079, "uuid": "f422a62e-f242-4cbf-b2ed-23e32459123e", "comment": "Malware payload (Formbook)", "value": "1cdc56faad7c822c9a05ce9dccf24484b9d34eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652100079, "uuid": "a676fc4f-dc60-42f1-a3c7-8a4b74343f4a", "comment": "Malware payload (Formbook)", "value": "c5387ca67e1e9f92c0a5f5e0b3de46d86ef2e6b79dbde68e1e703a1e312fb20f53642fec8e0b89c89680dfae753a8456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652100079, "uuid": "dc60f10e-f329-4efc-8f84-b5093196036b", "value": "T181A45D2C3B060A66EC1E93389D5D0A05FFA64B4372C0F99757CB15CACB4F4666EA5CC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652100079, "uuid": "74087854-3ad6-40a1-a0f7-cd86eb968ad5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652100079, "uuid": "68f1b00c-65d5-46c5-bb17-78b90bd80ed8", "value": "6144:wuz2rqsGyQp+42sVgB9YcACwsbez/gavFRQA/NYm6e1F5T2Wv+5S0hYmuQ4pf:wuKfQpPpVgH0JrFRhYmb1v+YvQ4pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652100079, "uuid": "9c60b45f-3c41-4087-861f-e4afce7ea031", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652100079, "uuid": "8c4a70f6-1f50-49cd-8356-b3b3d22c2688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652100079, "uuid": "071c49e7-4242-4444-bb10-4398ac402ed0", "value": "SecuriteInfo.com.W32.AIDetectNet.01.871.27087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9ac5cd-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1652084791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084791, "uuid": "95e20983-afb8-4cd1-b71f-9537620923c9", "comment": "Malware payload (OskiStealer)", "value": "70d95963a777564010067ad7fdb9eef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084791, "uuid": "c1612bd9-7000-4f28-9172-264e66495794", "comment": "Malware payload (OskiStealer)", "value": "de4f644a7b3c3248eff98dab022224f128f071a136b4c09eef7a54a0c11fbed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084791, "uuid": "535231a5-e7e7-48d2-ab76-d753962ccf2e", "comment": "Malware payload (OskiStealer)", "value": "33bb407776f08e598891f72eb35fe206db2f0cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084791, "uuid": "0b49c930-eff5-47f6-a6b8-63c1267d79ba", "comment": "Malware payload (OskiStealer)", "value": "a19cb1e650f30dce3754a0b1487e5a879a1f7a3db2a9bf9396b0a285f742bb53030fe28d4b4f98d889b2851a67cd71f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084791, "uuid": "9a638ba6-9f3b-42d6-867c-3ae5aca7872c", "value": "T1BCE418AC365C31DEC857C972CAA81C64EA6074BF7B1B92039063159D9E1EB97DF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084791, "uuid": "5a4853ff-da15-4e92-804b-ef4dbd6ff4b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084791, "uuid": "7e03a569-75ea-4089-8a7e-570d3782e0ba", "value": "12288:x+AGibRlF0aSiUlb2I3C4xEgcRPp1IPNVDA2iNnc17seNbeqtipCWRSFbylQ9voT:JbRlH7CbhC/1RPLwM1RcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084791, "uuid": "28803596-e116-4681-977d-245ac3ff4184", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084791, "uuid": "f4d40399-ee59-479f-96de-77211d2044e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084791, "uuid": "fbd48be2-d3be-43b0-9872-09d3fc4a3ab5", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b075a09-cfdd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130882, "uuid": "0080aeaa-fab9-4263-93f0-573a0987320e", "comment": "Malware payload (Mirai)", "value": "c9d6b874526ab495032b8f5fb1639d27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130882, "uuid": "a764c2ac-8464-4549-92d9-625a6719fe78", "comment": "Malware payload (Mirai)", "value": "dec276adf51bb75362123d379e6a686f8bc6189c7bff986ce651a5254ea131b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130882, "uuid": "e761bafc-57de-4807-a24b-00bcf3e13137", "comment": "Malware payload (Mirai)", "value": "cb3d0e45ee2fe755eee20ae826c1c24b89bace80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130882, "uuid": "ac6ff9a0-e947-42cb-b7b1-d2eaf81dbfa7", "comment": "Malware payload (Mirai)", "value": "8b0b123f45f5269094b932e737fc0ce5e3a1e9034fd164b70a7632e1bde691252ecb6747f5c86146472ae78f384ddc1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130882, "uuid": "47cfb766-11cd-40b5-862f-bc9b078b1bae", "value": "T18BF29D63C47D6EA8C259A674B4259E781763E104D2B72FF64A828365C007EECF21E3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130882, "uuid": "84635443-df6d-4352-a977-c79cb76d40fe", "value": "768:jaZhwtPfoHqeBdpad0IlpuNBrpgs43oC7MoE08hc:jaZhwtn2FK0IlpuNvgj3oMLElc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130882, "uuid": "081035e2-c891-4ce3-9a50-f714dce5f574", "value": 36208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130882, "uuid": "5122c803-44bf-4ed5-a669-8303e639ec90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130882, "uuid": "58b5816d-671f-4dbf-bbb7-fc66c2d6f62b", "value": "c9d6b874526ab495032b8f5fb1639d27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3a8a38-cf89-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652094999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094999, "uuid": "6b483cf0-c152-4b3c-adb5-9e48269f8199", "comment": "Malware payload (GuLoader)", "value": "c4d98bf51101a360464aed6ce0478865", "object_relation": "md5", "Tag": [ { "name": "cloudeye", "colour": "#D797DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094999, "uuid": "82098e3c-c833-4ecf-b877-3649b5766bf2", "comment": "Malware payload (GuLoader)", "value": "e0336f8a6cc091fe87b53bb94aa17d5fb038ea181abba78dd2b66654241db4ba", "object_relation": "sha256", "Tag": [ { "name": "cloudeye", "colour": "#D797DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094999, "uuid": "5c9c2023-74d6-4623-b8a2-c560d2391352", "comment": "Malware payload (GuLoader)", "value": "140edc78713d45014e93aa75f4e482aa3ef44f21", "object_relation": "sha1", "Tag": [ { "name": "cloudeye", "colour": "#D797DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652094999, "uuid": "add974d4-5b59-45ab-ac2a-afa77be65f11", "comment": "Malware payload (GuLoader)", "value": "e2e51a413f9f1a76b3a67a4d95dee4d1d2fc2d4b8cef8847b8d23018054e0010ea371f2f0754ed71dd97f48ed38d504b", "object_relation": "sha3-384", "Tag": [ { "name": "cloudeye", "colour": "#D797DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094999, "uuid": "4522aa5d-1769-4c46-ac34-065f4758b790", "value": "T15184E1D0B168E0D7DBA61E3625B7C6A76B64FC688D60061B3340BF7D7936243900FA79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094999, "uuid": "851316c5-7d84-470e-846e-a0c4fdd5211b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094999, "uuid": "3e5dce35-6a40-4ccd-bf7e-fd82ab93555b", "value": "6144:eYa6IbfUD/h5U1hCWpm7vJV4rrEvhkguqfvfQnMT9xd:eYaMD/7U1hC97vJOgBonMTPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652094999, "uuid": "efe73e39-59f9-4078-976f-51157b9b6c47", "value": 396768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652094999, "uuid": "00e1d339-c3df-4ba2-bfe4-3fb92e4796a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652094999, "uuid": "9c87a9a0-17a7-4626-be02-7e0c321c73b7", "value": "Docs advice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad58911-cfd9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652129405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129405, "uuid": "90295c7e-5b7f-47df-8865-5f91a5fa6783", "comment": "Malware payload (Mirai)", "value": "58a7896ea6668a4492176d21ba205704", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129405, "uuid": "8f3f8938-2eb7-4e77-b889-e75cbcf0c265", "comment": "Malware payload (Mirai)", "value": "e09fbbd7a9e18ea632f051148c21483ab2ef3622584e97a8c7edeb1e4826e678", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129405, "uuid": "3aab1cfd-3fae-4c05-9b55-961fb72f6bb6", "comment": "Malware payload (Mirai)", "value": "ca434315a24c3f765de67c122c15eba72dd38006", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652129405, "uuid": "b1554c6f-d5ce-4684-9b5c-309de6f4715f", "comment": "Malware payload (Mirai)", "value": "3614f5cf358df85b0814cb3492c5d1fe5c17006e9d7dc6b1071a7a6e1fb1a1c0625864e881d93dd0acb2e97511f45592", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129405, "uuid": "66769315-6fc7-4172-93e0-47746cf65ffc", "value": "T19733F111E2721F72ACB88877F4B001566AD987BC61C6F7B38248DA9C4562B4BF06F4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129405, "uuid": "ad169da6-2cb7-48b2-b1bf-89981b647dd0", "value": "1536:bOIlMtSFSIhqUXKpdhi41Hf/ZV9iLv8WHz:bOmMoBlapbief/ZDiLFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652129405, "uuid": "c292d7b5-ea7a-47b3-8d91-2a3d19c22b9b", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652129405, "uuid": "5abe5c8c-92b1-408e-a37c-d65b2182db14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652129405, "uuid": "e84322ca-d9be-4996-ad3f-6448c9621e7f", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadbe360-cfbb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652116654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116654, "uuid": "33a5c1fa-6df7-436e-9edc-3bf973c54dd0", "comment": "Malware payload", "value": "ada6c6e80665ef52fd143e6128e2bdbd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116654, "uuid": "e7a2dcfb-b9d4-436e-a7b4-13b2cdd5a103", "comment": "Malware payload", "value": "e16f3d3f8ebd25e52486771c6b662f6469e4c518290b9fe88b7c22d051c6ca8a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116654, "uuid": "50519b92-1c2f-4aaf-b43e-2aca7fbed074", "comment": "Malware payload", "value": "89527f18d2b300affecf91a9ebd5bb9e1e6f57e7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116654, "uuid": "e17c71bc-2aad-4ca4-b84e-214debe06413", "comment": "Malware payload", "value": "9fb17d1b5995ce2f27f65e5088abdb947bfb06e196e27c90161129fa14c0a85abf4618e528a25c893911969b12efb655", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116654, "uuid": "34b7959c-8b9b-4094-bd87-713976e06d67", "value": "T19F4142EE310B70369A5305F3EE2B10AFA9762126853C40C0BA04ABC51C69578D773EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116654, "uuid": "a18a2e71-a34a-4887-929f-38b7ef1cb6ec", "value": "48:kNXCcP6naqrn9SrfGCEVx4YJ8q09BR1xevDx6hGu:kNycS7rn1KYJAcDx6hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652116654, "uuid": "3eae41e1-0b42-4fd1-a47c-a6841c2a363a", "value": 2110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652116654, "uuid": "4cac268c-38b0-4cd5-98e1-6ac938d080e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116654, "uuid": "ee7e2cbb-dcce-44be-8e62-e72618be8ca4", "value": "Protected Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ac690e-cf7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652090044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090044, "uuid": "e47af235-8a6b-4495-bfe1-796e533a49bb", "comment": "Malware payload (NetWire)", "value": "c5da918a455ef96470c330252a08e460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090044, "uuid": "9aa93dff-1127-4723-9423-952ffdada17f", "comment": "Malware payload (NetWire)", "value": "e18028ec3cc96b8ebf3da315afccbaf914bc43b2798d5c5bcbcdb618221a5a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090044, "uuid": "3fcf72db-8b53-4340-9b02-50073ce8dc06", "comment": "Malware payload (NetWire)", "value": "65771bcad05c2919b9dd184ef3d79fe7a2033e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090044, "uuid": "151aaf31-658b-4a20-8d6f-334a30829611", "comment": "Malware payload (NetWire)", "value": "5ce2fa733538f1267a49f2b3235e1258a99762abb130b0cbe3ba592593b015c72f43f364267938fb2a2200b5f37d6a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090044, "uuid": "d3df3068-1ac3-49bc-9f51-48544dba6829", "value": "T109E42228B6FB2BA7D27597F06590414047F7692D70B1FA942CD452EE0AF2F480292FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090044, "uuid": "412e7745-1ece-4ecd-8916-854b50a1c7f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090044, "uuid": "0793c9a4-3ccf-4b4d-968f-75bf92db1354", "value": "12288:HNf2L2IwsItvdaeSw3fULehrPK3c+ofn8h6h9/KGtJ4DdlSQk8P7:N2stvSwYYPX8h6hQGt1Z8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090044, "uuid": "f4a7bd6a-8e70-4c5d-a275-1dcd05941976", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090044, "uuid": "1e081374-b67c-41c3-83bb-39e83d0c08a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090044, "uuid": "d814e9bc-c3fb-4c7e-81fc-b65845f7f3aa", "value": "Purchase Order 05092022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a39d6b3-cfac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652109862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109862, "uuid": "5bafc4f1-1036-4ec5-bf23-1530bcabe2c3", "comment": "Malware payload (AgentTesla)", "value": "d4dcf44347452fb33d207b2376ee2edf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109862, "uuid": "5b2cfb35-42ce-46ea-9ff1-47276520ffe2", "comment": "Malware payload (AgentTesla)", "value": "e2217f4513e9877391e25a57a8a9a320d11e0a0df51d6600b89616552e211927", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109862, "uuid": "38da1c07-8bb1-4588-bb15-aec8e58230cf", "comment": "Malware payload (AgentTesla)", "value": "729386796c9f95173528039292d2a23f080b416f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652109862, "uuid": "57988889-91a1-486c-bc00-9bba54a5234f", "comment": "Malware payload (AgentTesla)", "value": "803830ee0b8c94f70139cddf1479bfde1f81f55cc25eef87b8e81d85954334294208ac710b7bcbb1af01c3eef57fc0a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109862, "uuid": "5550919d-4617-47fd-877e-e97902529dac", "value": "T14EC45AACB12070DEF85BD472C9586C64A691776A431F02039433E7AE9E2D6F3CE55CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109862, "uuid": "17f6da02-57c9-40f1-ae54-87bc0ae8c351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109862, "uuid": "bb8f964a-b47a-4e03-8134-8025acc1d48a", "value": "12288:cgjjNMJ+k8a7ctEmGKmmqwizOn8d4KWhRyDRxO3SlwJZJpAPUPbTg6m:cgjjCUiTmGKmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652109862, "uuid": "8fbe8b2d-8e84-4df5-8cb8-1e9e41a11251", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652109862, "uuid": "9e304e35-2790-4ffe-86b7-bffae15f8228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652109862, "uuid": "21839d0c-def4-44ae-ac41-338f5a5eb95d", "value": "d4dcf44347452fb33d207b2376ee2edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c0964b-cfb6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652114277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114277, "uuid": "f27bf34c-69a6-47d0-8e5e-15482a382ded", "comment": "Malware payload", "value": "a74ff2695d904587ba0ccd69a283ca8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114277, "uuid": "b623f2b1-f99f-4e71-889f-da45b748ee7f", "comment": "Malware payload", "value": "e387a0332dc538c611fd3e2f01c9a746c7c664f0e2139d28d9c4f9b80fdfcc07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114277, "uuid": "c8b29b77-48ea-4f71-99c0-5caab42483df", "comment": "Malware payload", "value": "fbba6300974e88cc1f8fe81316aa56ac89dd8338", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652114277, "uuid": "0da6a3d4-eac5-447e-a65b-eefca3e9dd19", "comment": "Malware payload", "value": "c29cd48fd822ecd5bacf3c1cbdc11acd68aa14ad2f00070bbc61f04a9cdec3b3577237f3b310fd1cecb12c6c648bf91c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114277, "uuid": "7e4fc546-8f5a-4bfd-b018-05960772204e", "value": "T13EB35B143AEA4605F177DE365DE6A1D7C937BC81AD34958F3289330E0B73881B961B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114277, "uuid": "97921bc9-e308-4036-836b-42780db72d5d", "value": "1536:Uc4vseTW2WX9YcOpg4m7J4Mjrdt7CZmeV/6+MLs1uWQiwfDQU5IvcS:Uc4v89YcOpgLxrdBimeVLG9LQoIvcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652114277, "uuid": "c57ab562-6473-418b-a132-d2a7a5947480", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652114277, "uuid": "05c578be-71dc-41ac-9f56-2e708a311bd5", "value": "application/vnd.ms-outlook", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652114277, "uuid": "895d2504-d037-4602-aced-bdc39f935284", "value": "Probable Virus commercial invoice( BL Copy packing list).msg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f661b647-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (OrcusRAT)", "timestamp": 1652104648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104648, "uuid": "ce3c95ea-a2e1-44bf-91ac-a6d7254a9ab7", "comment": "Malware payload (OrcusRAT)", "value": "074333816e82613e878ba704e5905c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104648, "uuid": "1bb67851-22d0-46f0-9567-e9e6cebc39b1", "comment": "Malware payload (OrcusRAT)", "value": "e44a1c3c7069e3b2a2f3cbbd6e414f1c4fc1331e0ef96ea80780b958ced9bf57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104648, "uuid": "8c62be17-d727-4888-9283-c9c0200dc4df", "comment": "Malware payload (OrcusRAT)", "value": "9808d9b42c8053128f6507a9f6ae571b94a4e74c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104648, "uuid": "bcc0bdee-e2c9-4cd1-a471-1c6c4e284cf7", "comment": "Malware payload (OrcusRAT)", "value": "3d8f8017b4adbef8400380f793c3ce82dd367c34c36b7c6b9588e41c778e8f1962fcbdca4be4e762e473beacba21175d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104648, "uuid": "5b037d8c-418b-43da-9aff-f674b4efccc3", "value": "T15B15BF113FACBD07C1BE2AB8B2731AC817B8E8066152FB4E095451AD1DAFB02FD55367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104648, "uuid": "391a41c4-fd4d-40c6-a25a-399e496bbc2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104648, "uuid": "92034cdd-93fd-4d22-a1ff-446b18ac0ff3", "value": "24576:mtY4MROxnFf35sPebrZlI0AilFEvxHiM+:mt7MidbrZlI0AilFEvxHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104648, "uuid": "a659bbeb-cf6c-4a7d-b044-5234da6a2469", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104648, "uuid": "39505d7c-d82b-49d3-9a81-375eef9085e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104648, "uuid": "822a49e6-a3c2-4ec6-a96e-b7c40e595061", "value": "074333816e82613e878ba704e5905c81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d11e09-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652084789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084789, "uuid": "eb75e089-b685-4fe7-a420-d8f4c01c1640", "comment": "Malware payload (AgentTesla)", "value": "3fb91136aae5fc02d4a5e89c3f56395c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084789, "uuid": "110ca803-3529-4dd6-8544-314d3dec6626", "comment": "Malware payload (AgentTesla)", "value": "e4b25cedef5e122e9f68943bfa22ac12ebce3d7ef6e5c79e584fdea353f22b4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084789, "uuid": "39bd519a-e9c6-4828-996e-89b7298a2783", "comment": "Malware payload (AgentTesla)", "value": "7827e6f07011b532e95996e8f395a2182f7d869e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084789, "uuid": "3c34904a-16f6-4dbe-a364-10a769a6c783", "comment": "Malware payload (AgentTesla)", "value": "f8099bcaa3cb055cfd00f26568c5428e06d3526e21bb02e47e8b3f2aafb15b5aec171480a01be1904ec8cf2ebb84bdff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084789, "uuid": "71d0db8d-3bad-4f34-a34b-a084f0c5b07f", "value": "T12FD4232562BB833EDA7413F567D853D023B92C59B153E2523DF931EDC8A2B260521FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084789, "uuid": "4ad07dd8-e70b-4a06-a708-e74bc30bc7e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084789, "uuid": "fa842024-ac06-4d4f-b2d2-065bce00fe0d", "value": "12288:V2L2IW2iN/2iNXqd+akBtSDm/+rq/yAC8xGCAWayGvrK1BO2Vd7Vni:V2Y1J1cgakTS6Ny6ZMvm1BO29ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084789, "uuid": "e3fecbf3-0f01-4650-aadf-983ff14aa0ee", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084789, "uuid": "71946fa2-cd72-457d-8086-0b36e86105f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084789, "uuid": "bf006a55-2315-4ca0-877a-0901946556d8", "value": "orden de compra 4503455547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021160f5-cf70-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652084051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084051, "uuid": "1c1e131d-4d6a-4824-ae47-343cc8f8b51d", "comment": "Malware payload (Mirai)", "value": "73c69a8fb1a81033317758a5a49f78bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084051, "uuid": "df807d28-3ed8-40ab-91a5-e391b6eb6550", "comment": "Malware payload (Mirai)", "value": "e547ae20661d18ba888537788611edb224245b2df13673e61bcc25c33254e479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084051, "uuid": "823d3447-4bc2-463a-85ec-4992a960a16c", "comment": "Malware payload (Mirai)", "value": "d7f2bce1597aa680080809a600475e0aae70c141", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084051, "uuid": "0a9e69ac-7418-406f-a87a-660c6804a567", "comment": "Malware payload (Mirai)", "value": "70cfd86e1e08eba3a2b39012d871ed89710d06adfe1a68356d9c769fa9ec59465a9ad43fa10bb71042f712e8513581c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084051, "uuid": "101c7b49-d31d-4700-833f-2309b6deecc2", "value": "T12482D0DC53E3C14ACD34A2FB40164C5A738A362B8F4DEAE4CB2CE7CC79571AB4954668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084051, "uuid": "66dc769d-5c4b-447a-b5e8-c7159a997563", "value": "384:MNjxe8vcjHF1UNfeR/Xf3f5p9PCgfAhA0nrCxPFHYBIb2SrWe:t8vcjFweR/Xnf9NA3nrCxdjbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084051, "uuid": "d41e9bfb-91b2-4999-9e61-6f63aceec060", "value": 18396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084051, "uuid": "19f23419-06cf-4a2d-99da-8a5d6fe6398f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084051, "uuid": "cb193497-1756-465d-987d-552663d72363", "value": "73c69a8fb1a81033317758a5a49f78bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159beae2-cf61-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652077642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077642, "uuid": "42f5d53f-fd97-4251-ac97-b0cefed9bdcd", "comment": "Malware payload", "value": "4d0717055b3fc09fa51907612eafaa08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077642, "uuid": "411c31c0-83ab-4287-ac63-784289fba8b1", "comment": "Malware payload", "value": "e5704da291c57b35422e3b096323b84cc43f2ef4fc93c1db7bdb51e6eb29cbb5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077642, "uuid": "242284c3-c79c-4667-8661-5e54ed7337e9", "comment": "Malware payload", "value": "cd7fa4bb27c9c4f62ae41e31bb94a58768324fb3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077642, "uuid": "9737e229-8ac3-40fb-bb83-89dc494d8599", "comment": "Malware payload", "value": "c6d6f275f9e9a0274c03859b73972326fa20d1621b3600c64e1584d6e96128c38b7b1f5acba9789e5df483b859dc761a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077642, "uuid": "a077ca5e-0b5b-47d8-a2e5-e1f021a91cad", "value": "T1F25657F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077642, "uuid": "80cccb7b-d869-49f2-a27c-32bb8f9b9245", "value": "24576:SuWPxYwehenVW8j4odZuxNjXdoKr/uoS7Q4lCp6s283rXYFBPTr8ajs9QRlF0IxJ:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077642, "uuid": "f43bb859-12d6-49e2-b3dc-4ca5441d4523", "value": 5952885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077642, "uuid": "6f3887e7-8019-49d9-919c-43d5b634b9bc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077642, "uuid": "a07090ae-fa17-4f5d-bc9d-46de39dc554d", "value": "2022DOR0509.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd004d1-cf5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652077119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077119, "uuid": "3e827fb8-1347-4e8c-80e3-08dbe1688f05", "comment": "Malware payload (GuLoader)", "value": "4cd731810d45ef3ab5d1455dd1c5a75f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077119, "uuid": "e922dbf7-eaf4-4405-8779-7ebddd24431d", "comment": "Malware payload (GuLoader)", "value": "e576314ae45c5415ca59208b63c1793ed1feeda4e2cd83357855802656cf20b4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077119, "uuid": "a4f698f7-2562-4bff-84b8-e8b058282b63", "comment": "Malware payload (GuLoader)", "value": "de30ecaf8d295bb0470f5803c680a68c1cd2544a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077119, "uuid": "f694683a-ab5b-4ea6-b23f-f4a2caba6ae6", "comment": "Malware payload (GuLoader)", "value": "3785c3fb750494e9b5b5bb0a6e9eb080a2d2b560ba82c251cff74f2a4a11eafd02f2402063811f1ed24006b026a0fc50", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077119, "uuid": "da3276ef-0448-4e86-8c1d-06c3a67e8a9f", "value": "T14663028B9F2C1485D00F617E46ED93BC4E7731B48904DEDBC242AC989F584352ADAFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077119, "uuid": "5627c008-b863-4861-bd2b-2205f63207f0", "value": "1536:zaLCFcI4Jrdgi43EpmClss282dZXhh/20yXuwYtoM3mqIGjk:ECFcDxdgJ3EICSbddZz2WOM3mOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077119, "uuid": "370d7855-ded2-43be-a43d-0ac593e284c7", "value": 72958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077119, "uuid": "bd649079-a362-43e4-95b2-1dcc72fb301c", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077119, "uuid": "8cd6da77-b98a-4170-a2ca-19e8d1212b0b", "value": "doc8393983_884748399383764.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f630f9f5-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105506, "uuid": "2a09bdef-bca7-4a62-8f59-1ebb84817453", "comment": "Malware payload", "value": "e319449125b40a37f10f9335bc8f3ae3", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105506, "uuid": "d4871258-bb39-46cb-84c2-9bc59528c107", "comment": "Malware payload", "value": "e5833c38bc92d77252e85bc60581b58f471bf3232da3db6be698c84cfc54570b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105506, "uuid": "166d87ab-6f60-406b-a14b-7620f7df487e", "comment": "Malware payload", "value": "07ac01b370b064a94ea53cada5c313e1fd33c8aa", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105506, "uuid": "3d94971f-40ec-4258-9477-7e5aec1af524", "comment": "Malware payload", "value": "ce04d67a2c3906b1fa2b57f26dd7796e8a05f2e8886c49d7a695f0ec5b32a2968823ebfc790e307d683dede11b7d3722", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105506, "uuid": "756bfc8f-9b0d-4cd2-9426-26848332b22d", "value": "T1FEF2E0B57F5E4046C150A83093546CB018ECA144E28AE6D63B6492ED1DD7EE83B3DFAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105506, "uuid": "4ac64604-9c16-419c-934b-06d40fae2ef3", "value": "768:hcDplOK+WUkOPpG9+rlSUmKP2rOmx57Mo:hcD7OK+ZkgJrQXKPqMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105506, "uuid": "02c807a1-2b8e-4c0e-a4cb-20e1a81bffa8", "value": 34828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105506, "uuid": "88f6ae39-4e36-41f5-ae17-655ffd11387d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105506, "uuid": "7faf9956-f31a-4236-a5a9-142b04db8ecc", "value": "Todays Payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c78a66-cf5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652075146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075146, "uuid": "c0b28b7a-b54f-42ce-a8d2-b60e829a9c70", "comment": "Malware payload (Loki)", "value": "dc63882bf03bbc6a72c1f161e79b194f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075146, "uuid": "695d9e38-2486-4016-9f9b-46223f2d6e50", "comment": "Malware payload (Loki)", "value": "e5edd4128bd5a040d8b4a98275e5a3800fb29e7af5c81015ebebe1a1a95ad27b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075146, "uuid": "ad7fcdbe-e8ae-4ee4-b5d7-1549afbda7be", "comment": "Malware payload (Loki)", "value": "52b20ebcae19f3e6be89e98cd66404ae88d47edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075146, "uuid": "2b707847-e1b2-4f61-b5bf-49a9207565ab", "comment": "Malware payload (Loki)", "value": "b1cf97722789468ce6ebc92e2ebcab8d78171fb8d6be868770e18accfb8ebbb38e67fb56bd62798f76d6fb4dd567da3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075146, "uuid": "e2041afa-f102-466a-98f1-19cf832cec33", "value": "T1F094120D62ECA376D07D46B6A532510023B4BC672D53EA6C1DCAA0C58DA3F894B57F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075146, "uuid": "a2f8c2fc-e170-47cf-afdd-63bf28711edb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075146, "uuid": "4c62e5c6-b4dd-41ea-8fc6-cd49658cab29", "value": "6144:yTSOtDGjiHS9IlOwV2tI6wgjaLHQbzn+tO4FDs5let6CHu5VhM3TyRf9B+FHXsd:CpHEI2GLHtIlO6CHyhAeRf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652075146, "uuid": "e68bb918-9d98-4e45-8419-41ca748328c4", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652075146, "uuid": "7dddc3d2-de23-4716-8f1e-e09069fdf16a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075146, "uuid": "e4f7725f-a335-4d5e-addc-95d2a5bbc112", "value": "Termination Letter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a8d19c-cf72-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652085192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085192, "uuid": "4d6ba0c5-e289-46e5-a43a-986ba81469b2", "comment": "Malware payload", "value": "c3f125f4e79514cde54d183b21c4d76b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085192, "uuid": "049eb233-fb96-4cb7-9d5d-69c772969ec0", "comment": "Malware payload", "value": "e61717cf4a038f744842b962b3b4f0dfb6ad2145245246bb0f78806f6ea2cadb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085192, "uuid": "57eaac72-0661-4b0d-9f9c-1a3faf14b7df", "comment": "Malware payload", "value": "e5e94f5d5f20de7f2fa25da414171de2adedb220", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652085192, "uuid": "5951d14f-c1a1-40ce-9d64-7caadfc63d8f", "comment": "Malware payload", "value": "9311e285972cc86fd1f811e05b000c1e041b3d4009920cbe3f9118de34825b5232d12681da124dcfba39e7a67b0436b1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085192, "uuid": "c3bf81b2-37af-4adf-84b8-605db70e2160", "value": "T141B53352E8C35B8EC72E26F4E69FEB5D50C9BD4E1342AC71A39471822277F2A81D314D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085192, "uuid": "4e91e670-63b6-4776-9238-dd509291a701", "value": "49152:qmaHTnmkiSnF8SuPetBtltvdEUanTZKj:qjTmkiSF8Sc4zT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652085192, "uuid": "86cfb879-6f56-403b-96c2-30ab1bb4b118", "value": 2284032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652085192, "uuid": "30495b97-a8f4-4ca7-8827-9ce512c16405", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652085192, "uuid": "02f915c8-54f8-4e56-9f6f-b3940cdec580", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.4713.27435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e33c16c-cfb0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652111667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111667, "uuid": "2a0d62cd-0f22-4746-a20a-736a01815575", "comment": "Malware payload", "value": "1bc3405ce4dde7d51ce9db07f055958c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111667, "uuid": "0fc05124-5f8c-424e-a721-f5c2eb1872d3", "comment": "Malware payload", "value": "e68e23650e87a454d50100d94691ef412799e1a51f79bb193db7c42674a727cb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111667, "uuid": "72881a71-1029-481a-bec0-47d193e0fc8d", "comment": "Malware payload", "value": "6763b32483b1c50f7b6c13be8bf9237322134f85", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111667, "uuid": "0df15bd9-1c8e-4b4c-9a5f-e688efaf1f0d", "comment": "Malware payload", "value": "0d68a6ff7c513aa52052b8cf3666f8c0b7d2501e18808f4758acb2953ba6d35c9b51901078ee1d52b22de5a74d80d630", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111667, "uuid": "b8483512-dc43-4cbf-ae63-66f2d3c378e3", "value": "T1506533E11DFB390F6B1250B5BF59AC11672E228B1CA18C2357054B92E33B3594C7AA7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111667, "uuid": "88595a2f-0b14-4609-a3a5-aa1ee8276d88", "value": "24576:3pjrIyNz/08D4awoyIPqJpq/SaeHGFXkMs0CbNcNzJ5tAJjn1EBuPG1Lh:ZjrIWzsdoy6CpBHdh0CCN0vPG5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652111667, "uuid": "5d3573af-b8df-4c1b-bb24-682d2a421157", "value": 1452211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652111667, "uuid": "12f9a250-4f76-4ff7-8855-242b34ac6a0f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111667, "uuid": "43cecd52-b30b-4fa9-9193-1561abee28d5", "value": "Pricelist-MAY 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38fe5b8-cf54-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652072404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072404, "uuid": "7d9dceaa-654a-42bc-a49d-79756698471f", "comment": "Malware payload (Mirai)", "value": "e94d092d24613c0a6e0fd2bb8f1fe480", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072404, "uuid": "d0df7710-f493-421a-b9ab-2568d01d98da", "comment": "Malware payload (Mirai)", "value": "e6f0af700247bd35f08d17ca0a3e430199321a2032218a31cb11122f77ee6cbc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072404, "uuid": "d3ff663e-ff9e-45c6-97f1-c8c861d0ffd8", "comment": "Malware payload (Mirai)", "value": "d24e7d73f7f491def41d836d20130416b1cfefb8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652072404, "uuid": "18c5a430-a04e-412d-8337-b119ec96f62f", "comment": "Malware payload (Mirai)", "value": "033ece0a7f3f32c1c9509c556800ac3630a4225aff86633e21baea231fbce7113b98789effdc54e6ef8aadc4fc1b0778", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072404, "uuid": "41228fd4-cfbe-45f1-b064-6a922a252b32", "value": "T1E8537DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11A02D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072404, "uuid": "0866b56a-324f-459e-b636-94177d9fc599", "value": "1536:Z7qARubgzY/bEJyBRcpm80LDHhklv4JQC9DSW:NP+eY/bEJXmXBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652072404, "uuid": "f261c228-673c-4ef7-b548-57a73627915e", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652072404, "uuid": "7df49d4b-9554-41c8-9281-6e4bffcff85b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652072404, "uuid": "aa2a967a-1648-4ccb-9c1c-ba89f3a1ab12", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5916f6-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105030, "uuid": "f1056d6a-60ac-4fce-9f15-a154520e7561", "comment": "Malware payload (Formbook)", "value": "b94c8f5eb3097eb0d2990eb666c73a47", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105030, "uuid": "776284ac-3dab-4278-9538-708731e67ba5", "comment": "Malware payload (Formbook)", "value": "e6fb08acee21f5fe154ecd0ab1749a3b61f1e37a1bf6e8e1d1498423b74c1d06", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105030, "uuid": "1fe106dc-f056-4359-989d-67768157315c", "comment": "Malware payload (Formbook)", "value": "73f61e8b82cc8b0075846050fd8328cc0daf6060", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105030, "uuid": "523c5286-0f3f-4376-854a-35b8dde23b51", "comment": "Malware payload (Formbook)", "value": "ec126c9d91243c47573195fbdefac201437e64124f049f8c4f27ec7c71fecc1fdfda4bef0031577816a9538f55c05ec0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105030, "uuid": "0f431217-03d3-49f3-a823-0c54035723ce", "value": "T15C2412E471D4A8E2D0EF64753917654D94968C2F6CED48023E31383D7870963E29DBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105030, "uuid": "83e5fa36-c878-4f0c-ac41-861a53ede590", "value": "3072:U38xcWsgR8dEkyDNjZFyr4u+oxpudiWLlmj3vL8AXVivlsRJwS+P434dGb+o:k8xhsK8dEvDNjTyargvL8SaX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105030, "uuid": "4d8604c2-5b64-4391-bb15-02d619985f37", "value": 211560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105030, "uuid": "55e2887e-3e84-48a1-a7ac-869c8156c75f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105030, "uuid": "fa0e06ef-94e3-41ca-93fe-39f3009d5aa0", "value": "POFOODEXPO2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f290a0e3-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105071, "uuid": "83172fe5-a4fe-4cb8-aa2b-e4052aef43cf", "comment": "Malware payload (Formbook)", "value": "38139a35b230202b14d3221da94d4ec8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105071, "uuid": "8dec83f8-210e-4ce1-bd8a-7ee9c92d997c", "comment": "Malware payload (Formbook)", "value": "e854375cb78eaeecc84bef7a5789c8429814177f61e0508d4797949c4fa49b39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105071, "uuid": "3427f28c-5871-40bc-99cb-a3a8ce414ec6", "comment": "Malware payload (Formbook)", "value": "b6a6c8b1bf11f793667549686f5672f1c049ced1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105071, "uuid": "8ca773a9-2de3-4240-98aa-6cdd3db7ed85", "comment": "Malware payload (Formbook)", "value": "119623c3a43a4a2d823bd291b87889016ccf54367356a5e7b3c199cf3781f486ab804c31a05c765c4fc0b852d15dcf84", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105071, "uuid": "95d8b8f3-9983-4038-b075-9701efa0e882", "value": "T1512412007106115ACA110E72F30E9AA668A3FE6B25BCC51F390B7F6B1C70F740D7D9AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105071, "uuid": "17b5cf95-dccf-4eb8-8507-38524c06ec02", "value": "6144:LEPNVaYfUNs6gY9mn02sOQCfq/wtBAi3zM4gkdBNGtPN+:Lq/P6l002sOQCYwtBz3ecc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105071, "uuid": "689aef16-c9d8-4324-a8f8-c007b48b5ccf", "value": 212600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105071, "uuid": "af3a5c73-352a-41d3-b4fc-6bd171c510fd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105071, "uuid": "fec8586d-646d-4445-8d6c-eef1a592553e", "value": "PRO.INV.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7569678c-cf83-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652092405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092405, "uuid": "45c4c3e8-c0aa-4c4c-9671-5d758731448d", "comment": "Malware payload (AgentTesla)", "value": "6467299a17f711a43bd9360cebaa94ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092405, "uuid": "bb721ec7-070f-4148-9682-d0923b1c3b7e", "comment": "Malware payload (AgentTesla)", "value": "e87922573112845a03c400692d01c40099c8a3556b521d71e6d608530c54bf10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092405, "uuid": "b511cb42-b3f3-4c5b-8720-c9c758758242", "comment": "Malware payload (AgentTesla)", "value": "361e3964d5e9ae59db7e185ad89df25a39acd46a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652092405, "uuid": "dad64be1-242b-4a9a-b400-49a13673d735", "comment": "Malware payload (AgentTesla)", "value": "5f1759756b7c12d2573520d82fa48b13dbd7f9590c6be5c4ed4d10ee227d067524c01447afcf919f27aad5bc85fbaf4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092405, "uuid": "0af3accd-bab4-40cb-82be-ddf09dc4ed84", "value": "T1E12412813528B62EED9403F3176CD84075D9DCEEE8D96315A69F3B22C8BED570A434C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092405, "uuid": "ca6c7bfb-7033-4f86-88de-def55e40ac6a", "value": "6144:TjK3qTyJMUuOLKKy83Bwygtu/g5kVeH+PN:TjXeTJT3BwZC8V+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652092405, "uuid": "a1fea93c-0b24-4a7c-9e33-2f66f7a518e4", "value": 213608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652092405, "uuid": "d707fd91-504e-4e4c-8f19-abe44a8dcabb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652092405, "uuid": "0e1ba185-90ac-4605-99e2-70526c999c08", "value": "PO-S.L 45675675.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9b045b-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652104259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104259, "uuid": "7b670a5d-c273-49ff-94e9-d538c919e459", "comment": "Malware payload (SnakeKeylogger)", "value": "1e7919ee579e3c319d0db9cdd3bad477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104259, "uuid": "ba1eb517-0d3f-4577-b44b-0d125db2f0c4", "comment": "Malware payload (SnakeKeylogger)", "value": "e87e12b7cbbb1fc0cbbd8f096f4009187042ef948939393849a0da455b436c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104259, "uuid": "caadd765-0ce7-4657-a258-df65d858a09e", "comment": "Malware payload (SnakeKeylogger)", "value": "a59d1621a9ad8f8e3bbce26bd9b7f0eba9bd1810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104259, "uuid": "42361aae-039d-42e3-9776-664ec0ee4fd2", "comment": "Malware payload (SnakeKeylogger)", "value": "a4af26d2799a655c36b9a760be58e43a82f0bbbc12ea060ba92ea4906980100862ad406623bebc0e97f05341d7b09c58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104259, "uuid": "a53ed8cd-ca97-4e88-8378-a626613b8d23", "value": "T115F41BD1F19088DAED6B09F2BD2AA53024E77E9D54A4810C559EBB1776F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104259, "uuid": "cdcbd325-56d4-4759-9d78-8a7140b4615d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104259, "uuid": "f1c84ea9-f448-4e0e-8ee7-91d0f9918f06", "value": "6144:PurOqQS73belLWhI0KpN0df3UxilkMw/lMsBYkvy+9yiTDYD2EKSXjxo:Pnc73FanN0dfEA0lMsBYEy+dDYqxQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104259, "uuid": "94090a45-9d9f-42e2-8bbc-27e1c651158d", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104259, "uuid": "67fe7c34-e3de-42c4-9b08-f7041c53c242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104259, "uuid": "e7133441-7e81-4582-8f7f-76f6d270867d", "value": "PO_287104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd6ebd2-cfbc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652116846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116846, "uuid": "474199f2-e4c8-402e-aad0-bacbf8d4a1d1", "comment": "Malware payload", "value": "21765a6c100734752be783d88df8d79c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116846, "uuid": "c41e228c-c383-44a4-a753-7f0ecf2ca153", "comment": "Malware payload", "value": "e88ee5e75169e819506d4f4db23191373fdd8a1e09ab9e0d29cef5a911e9ca2d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116846, "uuid": "c2f43a50-8502-4a97-b92c-4fc9988889b5", "comment": "Malware payload", "value": "c7f12ff41ca00232979b2e97bf62da79429f542c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652116846, "uuid": "0fcbf5aa-cf22-4c25-94a3-c9fb8ed364a7", "comment": "Malware payload", "value": "eb4be108a2c904abec1d6c59125a710f05b07af26f9b07c3a7c1a000efbe775e0051181fe6714b07c7e64f23ddd1a697", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116846, "uuid": "0150f965-1223-4b26-915c-a72df97a0526", "value": "T1784122EE7117A061251308B7ECAF185E29B65323857E44C0B600FBD21C795A9E37787F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116846, "uuid": "e161f5a5-e167-459e-8a97-d4d721651072", "value": "48:AfNQjG4EJ3fqrnz+zgWlj4lJLT003dPlavn:AfN8LEJSrnz++lJDN2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652116846, "uuid": "e749eeb6-6d9c-4cb1-b322-e0a10d34b42a", "value": 2052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652116846, "uuid": "dc120148-0406-46ef-8cd2-e7c5a85a38d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652116846, "uuid": "d73467db-9491-4f65-8e49-2bd993e6b41f", "value": "Protected Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dfd278-cfa4-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652106549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106549, "uuid": "dc378d0d-1221-4c8f-adc9-ea2a99aa1225", "comment": "Malware payload (GuLoader)", "value": "cb8a3b39ee4e3c8644d4edc5a609a05a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106549, "uuid": "a2ddbe33-83e0-4d80-9383-12fe3efed103", "comment": "Malware payload (GuLoader)", "value": "e8db2b74f0a5c25797dd157233ae6642391017af1f5f89d3ba75c6736ec4ce7c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106549, "uuid": "06eb3b1a-8a21-48b1-a594-95f65f87e9cd", "comment": "Malware payload (GuLoader)", "value": "376bb65a768750983bee6559239838ddc8633009", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652106549, "uuid": "753d5250-7c04-4c8a-809e-0759c79f5000", "comment": "Malware payload (GuLoader)", "value": "de23c400abecb9427224ccf07f2683f5bfa8b6b6c799057293fc51f023fca96c97a2a9c5ffe1968c438e6c4d0eca5958", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106549, "uuid": "8e866618-85b4-4f16-8424-f86905de5c12", "value": "T15E24FD03961528B2AA2BFCA3D4F745B31459B79712EEB049D46CCBCC22741F78E39987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106549, "uuid": "7de87a2b-9b40-4a1e-b902-6a3c2421268c", "value": "3072:MgzVagoqaPE5SJ7e1FO5lnQ4pgd4C4eGL9Nw+bOXSOokJ2cUm8wtB8n40L/04DF4:MUVa71EkWbjG3w+ahT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652106549, "uuid": "f21567bb-6a47-47f2-b6ee-b66bda9c8c20", "value": 218190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652106549, "uuid": "de032ff8-9fdd-46ea-b15b-8dbd8b385567", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652106549, "uuid": "580e3948-0a0d-4d87-9beb-ca4254ecde20", "value": "ARKAISERIN.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ce440b-cfa2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652105618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105618, "uuid": "ce283b8a-8f3f-44c7-a427-4e2b5f575ec2", "comment": "Malware payload", "value": "e8c79d98c1d9d07a58597a32444d7c63", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105618, "uuid": "85315c1c-8fef-4b31-baa5-af6c7ea64f4c", "comment": "Malware payload", "value": "e9671d6667a716d9c1ab0e0fc9f657dfc718073f621d8085e88a52504a977336", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105618, "uuid": "c9598244-0467-49ec-883a-88344e6dc9e9", "comment": "Malware payload", "value": "668f2c7bb8f8b5d6b72ae4d6177597acfc32fd1a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105618, "uuid": "7cc9dd55-ec17-481c-986a-c1cdf5de16a5", "comment": "Malware payload", "value": "7cf45cdf33144be5f2a0e3b21d9a22074272f851677e516f39c5bb80d84703c8d768cbe336d38b9f90f6560e4ab9594a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105618, "uuid": "4be68330-c2bf-4467-a8ba-d85062fad8cf", "value": "T160F0DCE081092EB9CD20523BCA2BC609196864C84F2D2570A2D8F84F2991689BEA6087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105618, "uuid": "0fc56ead-e077-494e-8b3e-53d47510ca72", "value": "12:8rfl3OB+9L5Ph/xnnlf9pRf6Vsj7l8jriKMQJ/:8H9L5Jxx/jUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105618, "uuid": "131416dc-ae1c-409a-acac-74e67034ded1", "value": 519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105618, "uuid": "c27d9488-3ae9-4b17-81b7-587e26ad4c69", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105618, "uuid": "f91b46a0-549b-408b-a18b-c4ef1125e52b", "value": "Abrir_NFe2334344_091.07530_708.13742390.919388.71443.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efa91f9-cfe4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652134029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134029, "uuid": "9e164768-5910-444c-9ba0-c0473f366f1d", "comment": "Malware payload", "value": "d058d0669e24ade3811d7ed2dacb301c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134029, "uuid": "5417db3d-f0c7-479e-b86c-c7de8c2edda8", "comment": "Malware payload", "value": "e9e27536fa5ecb4a0619a8c48acb25767aead903b9e712498ecee9574ec1d3c2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134029, "uuid": "2bd23b4c-8870-44ae-8d48-512dff1b4a47", "comment": "Malware payload", "value": "f25fa5b37cdd754fb7705fd99d165df6b8ceff00", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652134029, "uuid": "c21e7c5c-16e4-4555-885f-fae2695742d8", "comment": "Malware payload", "value": "a856eae3e78fe2172b1c7c4bf9e5b2121dea3d5ce7bfbca395a79fdcab28391f4598264f504ca7510e14202eb5510111", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134029, "uuid": "d285fd96-db4e-4e61-9c52-844b1762241a", "value": "T1CDC533EDFC9BCC77C587957881B289C82DCF22D0F544746E20D5C358AA99EF98A1270D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134029, "uuid": "1e55b6c8-9c48-416a-91b7-ce090215ed30", "value": "49152:I8OmFETloaOITxwIDPmwxaDTQl3BSU7TRR6LYbyjVR6LYbyjwR6LYbyjxeT:LOHlnOIT1DROTm3BBtR6LYWR6LYZR6LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652134029, "uuid": "889f33ea-ec7d-455f-acd6-1d2dbaaa51a5", "value": 2542592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652134029, "uuid": "7c1eb85d-d1cf-44ad-8d36-170ad6c19ce5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652134029, "uuid": "01d6363d-1908-4aa0-9677-e17f33355f09", "value": "ezrail519.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e47dac0-cf61-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652077656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077656, "uuid": "e74f26ec-7f06-452b-b7a8-936ae8367532", "comment": "Malware payload (AgentTesla)", "value": "cea4c1c9a03d1b2ea92e247512406956", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077656, "uuid": "65bf3bde-cbe4-41d0-b86a-b86c0409ddb0", "comment": "Malware payload (AgentTesla)", "value": "eb4cd5aa7fb8e1b9c3683522220b936370817ac34e1ab19a676d83c2b5b6bd18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077656, "uuid": "d17ff98e-eed3-4768-bffe-0cf64d8a19fc", "comment": "Malware payload (AgentTesla)", "value": "3b6904d76e526cea869d5f2bdaf34722b65710b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652077656, "uuid": "5a778c47-48f9-40a2-b60d-94c5bde6c6bf", "comment": "Malware payload (AgentTesla)", "value": "1e2e311e6bda81d2aef237ee99bc01dc60eb303da7958a641b0574878458f60b817ce8e90a5b3b6b1622974848afcaca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077656, "uuid": "23b1ac59-18aa-4226-b2f5-096a4492ffdb", "value": "T118B4124E22EDA7A4C47E47BDE833621423B47D6B9613E90C4CEA20D669B3F484781F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077656, "uuid": "dc651801-f59b-400e-ba43-85881cb32926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077656, "uuid": "ecf1d862-f78a-4ce8-b0fc-d449137319e5", "value": "12288:t79zY66Vp6+OMnwgsITUWRdj75VvOvWtkmzy+X7dF5Fi3:t79MqLRgsITUWRdNZOvC7yO7dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652077656, "uuid": "3e3a76db-1416-4616-b8f6-8048dd33066a", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652077656, "uuid": "05ecb649-c9db-4003-a8c7-703d3b889e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652077656, "uuid": "ec810451-8a44-4637-8e81-fe2768d70a36", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3073ca3-cfdc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652130815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130815, "uuid": "40bb55d6-417e-4302-b010-6d38e25f99bb", "comment": "Malware payload (Mirai)", "value": "1555a8b05a8a0b7a7bec64ef9fef6a37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130815, "uuid": "41e6a9c0-229e-4a5b-aeea-034d1190138b", "comment": "Malware payload (Mirai)", "value": "eb8161473175dbf8ea21149678cfe58a423caed4cfd991205d55642811a4d108", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130815, "uuid": "606a15d5-b52d-4a83-b93a-b1a8b2e42a65", "comment": "Malware payload (Mirai)", "value": "cc9a64ff7c2987ce493a65700ba714d3f8f11520", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652130815, "uuid": "c0579065-cc2a-40e8-80a9-8a1d3ab927bc", "comment": "Malware payload (Mirai)", "value": "cf6dccaae81b9741a8caaf03ace5d36ace605db941f91ad7a03c6a5daef86f47cbde145ef9b70ecf4e307530f2bfe5aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130815, "uuid": "bb138497-97a1-4799-8298-f5e923420b7c", "value": "T187031896B801AD2CF85FE6BEC4130A0DF520775141934B27A7B7FD939D73294AE26E02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130815, "uuid": "de63521b-a882-4407-a8a7-b7bd914408d8", "value": "768:j8ooefpQkanDugNT4umiluUX980f0XlUe1URsZM:j8HGpranDugKKX980fmUe1Cse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652130815, "uuid": "4e8465f0-633d-4779-b10b-033e0005b33e", "value": 40324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652130815, "uuid": "20f1580c-fb50-49c9-8200-1d214c6181c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652130815, "uuid": "26a8b6e1-2da2-4a07-aeb3-1fb89f8a58ba", "value": "1555a8b05a8a0b7a7bec64ef9fef6a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fced2962-cfe1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652133005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133005, "uuid": "e13b62df-03b5-442c-8e06-3548084c14cc", "comment": "Malware payload (Mirai)", "value": "4d94c3c4eba7bf30fc824d9a829908ab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133005, "uuid": "59e2baad-15f3-4bd8-b94b-b24a3a305543", "comment": "Malware payload (Mirai)", "value": "eb9f74709a69189e81fa94f437cf906205c7a653ca1975331a7458a832a8ef9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133005, "uuid": "e0e6fd51-a95d-47a3-bd6a-8da874761a58", "comment": "Malware payload (Mirai)", "value": "8068bb895caee8ce5c0be0de6added207517eb9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133005, "uuid": "e22591f9-3ba2-43f5-a370-a30dc67455c3", "comment": "Malware payload (Mirai)", "value": "ceb7cb3d07a065fafcbad4cbe87994b24c5b253801ad72f193f8a0c7ede09e4c1608af47c379e91dfe57dbfd6f570019", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133005, "uuid": "0a97949f-e0c2-4a5e-816a-75f0af73b09f", "value": "T180F33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133005, "uuid": "51b91597-d901-4241-9e6b-8370d21ad024", "value": "3072:dUW6GNytEhMwZh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVytDSSuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652133005, "uuid": "6bcc8e31-df08-4f8a-a84e-0d1ff633a9fe", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652133005, "uuid": "af2fc281-9b06-4de5-b7fc-a64c83087f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133005, "uuid": "b27346f0-8489-4d59-a0f8-1428e91ffccb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac7740a-cfc9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652122318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122318, "uuid": "4907ea82-c929-4430-b35f-55c8ae734714", "comment": "Malware payload", "value": "4fd046bb2ecddeb5bc1bbc5749621890", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LogicBankBot", "colour": "#535CE0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122318, "uuid": "20aae9b8-4e27-4bb4-827d-564eb4750ef6", "comment": "Malware payload", "value": "ebef293104bba2df70c1a8f331c7d4acac5edd5d325bba0f1771216a5cda4c8e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LogicBankBot", "colour": "#535CE0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122318, "uuid": "7af17735-6b6a-4480-87f0-322b6f5e440a", "comment": "Malware payload", "value": "60ba3c7a2f4543376a3365a54f009705fb44ecaa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LogicBankBot", "colour": "#535CE0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652122318, "uuid": "458788f5-9800-4dfe-bcdc-216653ce0c00", "comment": "Malware payload", "value": "84add37051de76e09e087efd04be834c69bed5e9afcfe0f26a280ae0c83241fc134be69067d2770a2ef3832687bf281b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "LogicBankBot", "colour": "#535CE0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122318, "uuid": "2d915a7b-9c70-45ec-8058-66d9874273eb", "value": "T102D59C86FB48A97BC4F3933295355266213BCC658B43D687794C323C1BB79DC0B5AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122318, "uuid": "3b440443-13ad-49ac-a706-cf39fafd8a86", "value": "49152:PpNeBOU65RSsfym2gN6Rd/OuZoP/bLRX+Hfr2fqmIy8D:RNeBPTGNo1OuZoLgHfr2fT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652122318, "uuid": "fa4fbbfe-1c7d-4468-bbc6-a0b91c273c2d", "value": 2866339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652122318, "uuid": "94703161-c0f6-4c12-987d-739d217cb6c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652122318, "uuid": "7dbf1f64-2351-4a90-b0e0-30860773dbb4", "value": "DHL.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7620f038-cfc0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652118606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118606, "uuid": "e7b66f46-931a-4f2c-aa21-40a0da56ae59", "comment": "Malware payload", "value": "4a820a262b5d9bf2ff4600441e825ac5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118606, "uuid": "c71d39ca-57d1-4e34-bcc1-df6e8c369308", "comment": "Malware payload", "value": "ec46fd24333d9389c1194c20286fedf1a729825276874cc0c60925e5550527fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118606, "uuid": "9afe9354-0987-4335-ab2a-b3e85c5e0ff1", "comment": "Malware payload", "value": "c4496e6d2bd36eda379e3c320bc09920974eae96", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118606, "uuid": "a3ea4bee-6107-472e-8e7b-8b98784463cd", "comment": "Malware payload", "value": "d5feda6667e58876635c1d4b363df9015d248f71af5e677e0e246c7847391cac8a1449d7b95f7dcebba4edbb6a554b54", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118606, "uuid": "025cb7d0-ae60-4dac-ba81-e29e146d5da6", "value": "T1AF93504E6E714F7DFFAD823897B75E209309339616A1C588C1ACED025E7038A741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118606, "uuid": "97774c03-09cd-4248-8cf5-22115877068f", "value": "1536:PUGBUiX8EwS5U38ka9fkKSdkVD+lW8GIE2IvSk7IB63Hi7APRKpgUeDO:s4lMET7kKSd2+lW8GIE2IvrM8Hi7APRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118606, "uuid": "6f4a5053-71f6-4fa2-addb-9d4529c42d87", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118606, "uuid": "0f256c95-395d-4066-a20a-fe68ed44fb25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118606, "uuid": "43a82e58-8eef-4940-9a37-2fe5720efa50", "value": "1isequal9.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f450d09-cf69-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652081201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081201, "uuid": "1aa0c90f-60c3-450d-a070-0fbe7aeb017f", "comment": "Malware payload (AgentTesla)", "value": "679cde33fcd1f2771a888876c4842aa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081201, "uuid": "d44dc19a-0a57-4a31-b6c8-7d73b5a604ba", "comment": "Malware payload (AgentTesla)", "value": "ecfb935ad34e95a75558cd6ece8a375679da481045c86db3c14bbae44eaa6da5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081201, "uuid": "75127ca5-460c-4a51-9f61-3875e7a2e680", "comment": "Malware payload (AgentTesla)", "value": "67d029fdc346ca6bc72cae9c8bf18cb3f3c27fec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652081201, "uuid": "46727bfd-40df-4dc3-badf-a719b277dc5e", "comment": "Malware payload (AgentTesla)", "value": "cda4780bd31922397e7c2306c163c10b8622edb431cb54e9a8351f9db0019f835ae50870935002cbf1b08d969f9fa6b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081201, "uuid": "0f6ae171-d097-4d12-9d06-efe47e81a6bc", "value": "T15F050111FA6C3C51C95BDB7A5450D10041A6E74FBA3EE52B6EB33C8E9874BC212A1E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081201, "uuid": "4c84b443-9947-4056-bc61-78b2214b6e46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081201, "uuid": "5add6c06-5f6c-44d4-913a-dd72702cc7eb", "value": "24576:ICgjjWvqC96HEdbosbY9jFHJDSB6M0IfI:gKB6HEdfbY9pJjM0Iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652081201, "uuid": "c9892f20-ba9c-4e32-9892-9addebe3a90d", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652081201, "uuid": "0a8e19aa-8c98-4992-83fe-2b4cb8f79f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652081201, "uuid": "ad1fd580-a959-4b0a-a041-96052b3e9f96", "value": "NEW Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e026af-cf70-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652084278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084278, "uuid": "c00e1d4e-20ce-4d33-ad89-ec702b9bab04", "comment": "Malware payload (AgentTesla)", "value": "4ae0e62a9dda8556baca73e2a8022899", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084278, "uuid": "8dbec283-92fa-4bc7-94e6-56a6aee0866d", "comment": "Malware payload (AgentTesla)", "value": "ed374e0b094ff23907497ed79a603e0b20bdfc268ea5fc1fabbf559cf0fab235", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084278, "uuid": "a2cff2eb-7357-4e4b-b45f-7bc198f3db0f", "comment": "Malware payload (AgentTesla)", "value": "724aa3a66abdb0f3d8cb06bed5ca6c708556879e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084278, "uuid": "14eca4d0-d210-4dfa-8c39-6dd49bfa5c4b", "comment": "Malware payload (AgentTesla)", "value": "92f83836a0e466e96948c360f1b665422a5ad5f91a347c94474064f4beb1557dd95cd39d8048aac8bda20ad92f5a1427", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084278, "uuid": "a36d4cb3-c7f4-4e3e-8a3f-6d248dc20c71", "value": "T1F004A223B17CC5E2F89C3DF48A0997646AB42E920639F15BD94FBDC6E8B3223C2055D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084278, "uuid": "89dbe7d1-c79b-4c1a-b38f-464c59f51670", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084278, "uuid": "6d70fe75-50bc-4e77-b860-f7a4fc20f7ac", "value": "384:bJhkW7gLtshmo9141fo6UKsMQmZjVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalZ:VyHUTso62m5vqGsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084278, "uuid": "71cdf55d-1d5a-43a6-99ea-b00381c8e523", "value": 175104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084278, "uuid": "f5a01b88-b60b-42f4-a710-5155a4b4f994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084278, "uuid": "6a9ae5dc-6610-421f-bd18-55b4060c97b3", "value": "MT02000728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3334be95-cf4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652069102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069102, "uuid": "ab039486-1b9f-4d06-9731-59def3da6ff0", "comment": "Malware payload (SnakeKeylogger)", "value": "489878c641381f627db281d2af0271bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069102, "uuid": "707d68c8-7690-49f3-a98f-646231785839", "comment": "Malware payload (SnakeKeylogger)", "value": "ed406bf65b9ee9c2f1e695b06fe2719868b4e8917ef2bde8052b724e82476c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069102, "uuid": "495a3299-71b2-485f-aaf7-5f341e3d51f0", "comment": "Malware payload (SnakeKeylogger)", "value": "f5aba887721cd4011e15cd5a4c23f0ce7ec6be2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652069102, "uuid": "6bb1d982-0d79-476b-bb40-22bc9c245f3e", "comment": "Malware payload (SnakeKeylogger)", "value": "9012b4a7fcaf9542d2275107cf1ebfd4ddd1775fcc4d089f90825c0f194b366fcf0717cf6f53b68d7f7ffe6cfe3fac33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069102, "uuid": "d84e0e4d-bebd-4ee9-94b9-56672d3323fd", "value": "T1A4F4F111F66C3D95D55BE7769910C000516AE38FBA3EE45A2EF33C4E68707C252A2E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069102, "uuid": "2778bc3c-1362-4ca3-a3bc-0916443a10b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069102, "uuid": "f12535ea-3cbe-4fc0-aca4-f0ef4d6f7716", "value": "12288:d8gjjWjrd4aA1cmizwp9+SzS+m9jJMcYIX8nUBUxESk7kEbb:d8gjjmJOZp91m9jL8ncU2VkEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652069102, "uuid": "38954794-243a-41f9-b54a-b2980315667b", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652069102, "uuid": "4f802f09-a0cb-4c6b-8cd4-0206bc1d30ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652069102, "uuid": "7f0cadb9-40b3-436a-b098-a2f7f738ca07", "value": "details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0265e60-cfd2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652126407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126407, "uuid": "44ce6cc5-e15e-4c8c-8191-32aaa6096f97", "comment": "Malware payload (Mirai)", "value": "c917ed7bfafaeac30080d8fbc9c3044c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126407, "uuid": "91b70dfe-d949-4f29-b5df-3006327c2b6a", "comment": "Malware payload (Mirai)", "value": "ee90efaeca52d17d03e7fefe429097282a938c113d0d1615751bc5e462c6c9c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126407, "uuid": "cd50449c-44ed-43b1-bf9e-71cc02fcc55e", "comment": "Malware payload (Mirai)", "value": "61c19e1d882f12363ef3384f164030af7ebc20be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652126407, "uuid": "f413de9c-cff3-4a05-9289-fdae579b9cec", "comment": "Malware payload (Mirai)", "value": "60680ea2bceb0cf0ab2c28505bb88fe6e079856e557a7a7faa05ba1e10fb23a80b3a486077265923e29d5f0c2860e6f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126407, "uuid": "10be5e9d-e86c-437e-a063-2fcee85adba4", "value": "T117E2F896BCD25A2FC5D062BBBE6E44AD3320B3ECD1DF3217CC145B547A8690A4DA3B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126407, "uuid": "369dbbe9-9df5-4a70-931a-bed7e175989e", "value": "768:9gQQ8tYH+LK4wOOAQFBUj5RvMhk5ZjuBNLShHKK65VB2cD0S3FDW+OSN:9gCW+MApRvseoBNWhKV3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652126407, "uuid": "98d8cf5c-0642-420b-aee4-b2aa7250d938", "value": 32908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652126407, "uuid": "bd7cd910-9b6e-4590-b781-f10e87f98733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652126407, "uuid": "543152f1-2ef5-4484-abcb-06e3b01043e1", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a968f08-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105138, "uuid": "c2680462-e446-4f05-be28-dc58b01d5fb0", "comment": "Malware payload (Formbook)", "value": "a073baba61524eda207caea75a58a412", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105138, "uuid": "6ebd408d-a6a6-4f08-96b1-d9a5d69ec6e8", "comment": "Malware payload (Formbook)", "value": "ef4afeec03ef9ba7863a99ced8e318dd418f2aaaba26acdba7146dcb64553d7c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105138, "uuid": "f0929552-3901-4969-9b6f-9256d34de313", "comment": "Malware payload (Formbook)", "value": "197e703b6551afef8ebc79359f53ebda8398361f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105138, "uuid": "6f46c906-b537-44a5-b2af-de523eb4c9ad", "comment": "Malware payload (Formbook)", "value": "9cbd1e8ae6a0d1606a20e898c7cb456e23ae3eb628ed7086eac5228af884e7f2f1eb8446c22678a1d79070a01bae3947", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105138, "uuid": "73048785-3a57-43e9-b8aa-64cdcd3581b3", "value": "T19F24120D3BE27702D076383F898F92067953AE68F966CC6A27CDF237D2B175D4589610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105138, "uuid": "af88c7d7-474f-49a4-8c0c-cb9c4edffc98", "value": "3072:+tfpEybAt2n23HO/RS49DAtk1jIjEDu2N8dWVJejG+kdb90q45KXr/gLTBM4FAHR:8GPh3HO0Kr1jI4S2Kd4JejG+k0zKoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105138, "uuid": "7c426e49-f429-49b0-8bdc-56d1af07ea92", "value": 212120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105138, "uuid": "372ad437-cbf9-4522-9f98-c72421641e7b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105138, "uuid": "0773daaf-ec60-4d3d-aae4-8614e6cb7192", "value": "Quotation Request From Wnsche Group.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672b9e36-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652105266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105266, "uuid": "086bece4-e578-47bf-aaba-b3e435574257", "comment": "Malware payload (NanoCore)", "value": "f660105b981e29b734fa4e9d5baf9c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105266, "uuid": "d9e6cdf0-6d64-41a5-a580-eaa294ecd326", "comment": "Malware payload (NanoCore)", "value": "ef83f00952dab1229b5943f9afde55837ef0d46d3dfe6b11063d85bbd4a1a8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105266, "uuid": "265221ae-57e0-438e-b279-e89a1761cdfe", "comment": "Malware payload (NanoCore)", "value": "2262d8aa62f88fc7874f7ae91d4dbe414d345dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105266, "uuid": "8785a975-d54c-420d-aadf-247553394509", "comment": "Malware payload (NanoCore)", "value": "3c556fe4a5bccb76c68778894237dc1a739edc4a194dee429106c243417023cc0b1fb2de92f3308ea0013140d7e77b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105266, "uuid": "bcd3659e-63f4-413c-94a2-8b463b27237e", "value": "T181B25301F2849371E3A2177778EDB14CF2AA9C2D061BAA9AF8503D5C1BB12D11EF653C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105266, "uuid": "f6d37028-e4af-4221-aab4-1c1e3a4669a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105266, "uuid": "35d4df5e-64dc-4684-ad4e-99d2d90350d4", "value": "192:5m7Js7NmJ6He1lhWhzmACc+pJ6pYL4+EvNesGT+:5Is7NO6HUlhWRPFYsVvNesK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105266, "uuid": "5c57dd34-be69-46f1-8a96-fb14fac5da10", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105266, "uuid": "5e10d748-adc2-4e2a-9d75-a649554609d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105266, "uuid": "7d75ffae-1ffc-428c-84dc-9daf130795d4", "value": "Habib Bank_Payment MT103 Copy_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79da1cb-cf5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652075337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075337, "uuid": "14209cb9-8ec5-459b-b892-284c4e7d8d8e", "comment": "Malware payload (Mirai)", "value": "647fad471b9ce3a298133fb9b0ac6234", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075337, "uuid": "cc478d39-e567-401d-9ae8-bce4eb553e9d", "comment": "Malware payload (Mirai)", "value": "efbdbab16d52fca96e68a88ba465cdd4c75758aa35e6cd25cfe4f1e9b6b56fa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075337, "uuid": "fa1c6e5c-2cd8-449a-963a-734fb6ae2ca7", "comment": "Malware payload (Mirai)", "value": "7affa4bd2a45217af299921660f18e1e419d0f3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075337, "uuid": "c0c8d783-ca11-4bb6-8dc9-d91db29d4456", "comment": "Malware payload (Mirai)", "value": "6004e237df197219e92381d4130c7675dbbc0345f04ce584afc4d3dfc6cda2a4a581f312c93f4fbdfdd26c3e18b1fc5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075337, "uuid": "7912ab13-3abf-4891-8ae6-9ed8654166df", "value": "T1CF732ADAB800DEBCF40ADAB64557490BF531A3518E930F36662BFD837D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075337, "uuid": "8257feb1-21f9-4bfe-9f06-529e61e94c08", "value": "1536:awW0PKt9cwxjQ/bIXIdZzN39D8Utia84GLf84Eo5WOK+7c4R6yN:awsgVdZzNVFtijjESWBryN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652075337, "uuid": "2902dc3e-d701-4b58-a5e5-b5db16cc2886", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652075337, "uuid": "1b93539b-03df-49ac-bff3-8ed11d1fd42c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075337, "uuid": "c0eaa318-6829-44e2-965c-68e20a7ef6cb", "value": "647fad471b9ce3a298133fb9b0ac6234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb645a83-cfad-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652110642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110642, "uuid": "9cdb68fb-63a8-4ea7-a340-6dfc71a601d5", "comment": "Malware payload (AsyncRAT)", "value": "e4e179f51117405910ecad1cbe518f99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110642, "uuid": "94dab57d-f644-48b9-b8ac-2fb871a05a6b", "comment": "Malware payload (AsyncRAT)", "value": "efd132ae0add8b50e51b21cdc9240d7cde21ecff4a4be28e6f63fe8abb7390c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110642, "uuid": "3b0c1065-bcb2-4026-8fc1-4c48e9a64aca", "comment": "Malware payload (AsyncRAT)", "value": "2a97899e07687f2a728f913e0463658ae9fee417", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652110642, "uuid": "a070e713-dd20-4276-b57c-f31b62ed06b4", "comment": "Malware payload (AsyncRAT)", "value": "054aa0bd03919a8d7ee565e3342be8f144675bef76a7e3aadb14e1ba987661e908741eefc8ffd439f334038a05dbd02a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110642, "uuid": "d4c7886c-d8fe-48b5-ae32-2a87421ffb6e", "value": "T130948D4A2F886A24D2BF76709A9CB125C3F191DF576DC35B4886F1D53B373847AC02A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110642, "uuid": "109d391b-bb89-45d8-91ee-1bfb0af79a79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110642, "uuid": "094d65c5-0209-4971-9bd4-6f89ad89b6c4", "value": "6144:ig2sR7jRlHie6ZufgZXEG7YLRXfUMfyDN0wjtm4iZBu:igXjz4ZagOG7MRUMCNNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652110642, "uuid": "d591b712-9ab0-4890-9d61-2e6fe57d34a1", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652110642, "uuid": "d1d3d133-75c2-4dd6-9288-7f4d632f10ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652110642, "uuid": "49da8b9b-6594-4239-8875-716b7afc44a6", "value": "e4e179f51117405910ecad1cbe518f99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dd395e-cf3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652063419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063419, "uuid": "d40877c1-fe95-4f95-b8bf-5d4c0bcd0632", "comment": "Malware payload (AgentTesla)", "value": "e3e452573fecb14a54320b36d01bf253", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063419, "uuid": "e2ad35fa-3b92-4e74-a125-3cf7d84ccac8", "comment": "Malware payload (AgentTesla)", "value": "f0c9c16f51cfb4de3e7d7d698ff9871048be054b8504ee0de8f6432f1ba1de0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063419, "uuid": "ea9d0a81-c59d-4a31-a90b-694cdb3ede42", "comment": "Malware payload (AgentTesla)", "value": "09677c07edf2b1af706a0652a1eff9df96e5d641", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652063419, "uuid": "71a61af1-c1f3-4f23-b752-0d2a1b32dc5e", "comment": "Malware payload (AgentTesla)", "value": "6e389c3971d10db1e2ec5581ed02125d0d5e557ed2249ab176cd2e785434aefc4f44302b9c3c7cc2f4189ec9f7238e77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063419, "uuid": "98980775-3d82-4afa-ad6a-097f7c19b26b", "value": "T1CDF47C98B01460DFF41BD0B1C9682CD591513E7A871A420E6473F7AE5EBE6F38A16CE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063419, "uuid": "eab58747-93ce-4ed9-bc47-14d806379787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063419, "uuid": "6754394c-643d-40e0-a846-876fdceecb6d", "value": "12288:ygjjJrKEq9DYQdolBdDBudTWaVW1kiQ95xnVn+ryfvQd7xlGrqL2DHcqxpVhALr+:ygjjJr6D2dNuJNVW1oDZsrQIx0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652063419, "uuid": "e1fb9a91-18d2-4e45-889f-cabf678d049f", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652063419, "uuid": "06f049ed-3a68-42ab-9dec-ea24cfdbdb6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652063419, "uuid": "e009349c-8571-4347-8587-1bcd9607f6c2", "value": "SecuriteInfo.com.W32.AIDetectNet.01.25700.31292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96df0094-cfa1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652105346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105346, "uuid": "63dff0b5-87dc-41d9-8549-c2efda2c03a2", "comment": "Malware payload (Vjw0rm)", "value": "b7fb6b8f80346a3dce4e7aa2265be76f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105346, "uuid": "fa4837e3-ce80-4c17-b93c-424f07d4d91d", "comment": "Malware payload (Vjw0rm)", "value": "f1f77a035e0ee8906d7b836a3d2cbb0e04412751ac2357ad6f9b5f4740e39a3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105346, "uuid": "1d7cb54a-dcca-4667-b4ff-bdc77fc3bfa4", "comment": "Malware payload (Vjw0rm)", "value": "8b380f3cafda1640b27585b1905aaef476649849", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105346, "uuid": "d79cdfc8-38a4-4d93-813e-a7f11796fd6d", "comment": "Malware payload (Vjw0rm)", "value": "5d749b8d908ce255e00c9d18190d5285b5fb25cb4cafd4cb9696e9769d21a49bdf1119d3b6b635b2b384e53ae8686ff5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105346, "uuid": "b97fd8bb-b0e6-4659-a11c-6c6a4df3d817", "value": "T161B3EBFDF0051F228252755C88DE0A1873B2E722F5E9DF01466C6609C1EE92B57CEED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105346, "uuid": "f89a4222-1a99-4799-99ac-dda55dfb4762", "value": "384:s3BRPMfH/ig7LmgeHWWKGKpoNXoDoNS6/oNO:h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105346, "uuid": "3902fa75-8fef-4b17-9c15-8b94c58fe5a3", "value": 115024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105346, "uuid": "7dc01f36-db4d-4bd2-922f-867e6d5c8607", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105346, "uuid": "3525250a-1a57-4075-b448-e40450e830b4", "value": "Payment Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22a26fa-cfbc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652117015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117015, "uuid": "c6ffd7ee-9e92-474a-b8f3-f1c9d18d6ed1", "comment": "Malware payload", "value": "d7763394097db2c01a48e09cfb5b893b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117015, "uuid": "73b0a7e9-939e-468c-892f-0054f7ba51c4", "comment": "Malware payload", "value": "f2027e57addce1b3749967082d9a6ebbccbc335652c6c9246d2bf14aad42f00b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117015, "uuid": "45c46d01-9975-450e-8b86-376dfe9eee60", "comment": "Malware payload", "value": "ccc4372703a73af073f7d83a27e00a8c238f3f05", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652117015, "uuid": "6b11cfd7-0c06-4786-bcae-8f87b1fe3b66", "comment": "Malware payload", "value": "e436e96f26bffc18ed72dd7f295808fac1af1867ed29d237903c7f65472fc2de9f6829ac26ea6021b787aec080a3ec5b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117015, "uuid": "26ff8cee-6176-4ebe-bb06-09de60bd5d40", "value": "T19A13C014779AC542D06A87B29FC9C2DF26797C95AF0787233282334F19786A1D86332E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117015, "uuid": "659fcbd8-c1a9-4a94-8011-df4860750978", "value": "768:Ao4VSxRUG9NJozFSoDC6VQCSpM5wwDIudE/8FC+LukV05:AoFxRUG9NJwSo+8gMiwDIKE7+/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652117015, "uuid": "3c6fafbb-0db7-4f2a-90d3-9d0a3125e78d", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652117015, "uuid": "db7c7d17-d5fb-4670-b33e-3c60361cc3cf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652117015, "uuid": "81b07a71-85e7-4a51-bdc1-92f3b7857704", "value": "ACH payment copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bcc8c9-cfa6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652107269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107269, "uuid": "853a20b3-e79c-4e32-a7a9-310c3a1d10b9", "comment": "Malware payload (Mirai)", "value": "0dc79ea611e4e6b4e494101e25923712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107269, "uuid": "51bb7bca-57b6-4b4f-870b-b06a92e1b458", "comment": "Malware payload (Mirai)", "value": "f2777c10241b561637e5c09bcf4e53de847565eaa5f9e5319880ead9392567bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107269, "uuid": "96f43bfd-d18a-4d39-b829-a2d2cea41baa", "comment": "Malware payload (Mirai)", "value": "0b9280e5870cdf61733c2e47bca0ae10da568d52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107269, "uuid": "2ca9c260-46de-4437-be92-84c9e870fbea", "comment": "Malware payload (Mirai)", "value": "2b8296204eb74938c6025521d875365938d55004ef8c6ba6a9477d443a9ea9dd0632451427fa63c540c44c40d9b79338", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107269, "uuid": "deedb598-ed8c-409c-80dd-4e419f7b8bf2", "value": "T164333ADBB8029E7EF48BE67A405A4D0AF53122C11193173373EBFD93BE321549952E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107269, "uuid": "7b89e1da-8ba2-4ad3-83d8-297a64719c96", "value": "768:/vSPF+B8oMZduRLVQxbVS/gFHNHAEuR8L8v8b974VkfXEBfvob41:/668vG+tFNHANR8L264VkfUBf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107269, "uuid": "52955d2b-73e5-4b33-9c15-c512e9d6b8d9", "value": 53544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107269, "uuid": "824b4663-b7bd-4296-b9ca-7630947eec1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107269, "uuid": "03520d94-864c-4bb0-97f6-97ae32c88cdb", "value": "0dc79ea611e4e6b4e494101e25923712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc3a70f-cfcb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652123561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123561, "uuid": "b11a75ea-c6da-4061-8ccd-b3ef5f97f5b2", "comment": "Malware payload", "value": "8b9bd67d8bc593a3928470a772055bb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123561, "uuid": "8832bd6e-c7a0-4f42-8462-bd96abd694c7", "comment": "Malware payload", "value": "f29fa4b5dac695e0ceff091a8679c94129387f2a03aac03d011db98229bb6166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123561, "uuid": "40b899b5-fd9f-4866-9658-cfd7f06a234e", "comment": "Malware payload", "value": "d31c3a8dc7fc3d08ef91f602f89f275240c523bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652123561, "uuid": "b868a0b5-e881-4f12-9578-cc6f01e7c6f0", "comment": "Malware payload", "value": "c84e7c1a2bedf085404a13d86b57d4a6823622784c4655cb6d57c3012e39670e564cb84493d7958794cd9d2c88819e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123561, "uuid": "03d628a2-8391-47bd-963c-0ae8e1250892", "value": "T176F3026431E0D4BBD9B787720EBAF6260BF9A92A14E147071330BED87D72681570FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123561, "uuid": "db5c71e3-eadf-4ebd-a55e-75b0f18b4cfc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123561, "uuid": "d5f0864a-5fd2-4489-8c96-7b3457347298", "value": "3072:l1NjcVVnLpPunb+V+2YljRphHyRBvcxUZOR+wokIqyogujd3urJQdGWA:HNeZm+hGPHyLkGC+dhqyZujd3urJQ/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652123561, "uuid": "ff2fe39e-a34f-49d2-a775-52e377e1ebbb", "value": 161706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652123561, "uuid": "afc1adb2-c706-49cf-b58b-1fb258980495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652123561, "uuid": "4c2c090f-053d-4029-9e4b-05aaa956deca", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276715bf-cf6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652083255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083255, "uuid": "c30178e7-136c-4e31-ae7f-da197ba2bfca", "comment": "Malware payload (AZORult)", "value": "1549d8ec14f63627d2dea3dca3943f5f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083255, "uuid": "db7ea691-30ad-4c5c-bbf2-ed77d8d24a1a", "comment": "Malware payload (AZORult)", "value": "f31e2c4dd2e32c2c3d1cab973485593a474d8ffad44e759970e536aebacc46a2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083255, "uuid": "a3e7814a-ccda-46da-a260-bfa1db9ac9df", "comment": "Malware payload (AZORult)", "value": "6f4827f6e0d867224e8fa2233942d6584bd24039", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083255, "uuid": "c2c362c9-f267-483d-b0fd-b2578b9415c4", "comment": "Malware payload (AZORult)", "value": "8805e2abefe87e5e21d42f7b77a3b211df0cd6fa98b6091e773a358f336030eea0112ca3ceb62625ab5758b3cec80a91", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652083255, "uuid": "fb63808b-99c1-4f73-92fd-79ba924dc235", "value": "T10BE4F120E66C3D51C85BDB748411C5405166B78FBA6FE91E2FB33C8E64B5BC262A0E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652083255, "uuid": "2e6eb52d-083f-42d2-a745-09b0213e3b08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652083255, "uuid": "3fae57a8-35a1-48cc-a0f1-d20ee304e6af", "value": "12288:COgjjY4pGRXXtgh7+/SbwJ4qZ/iVuAb7XiW+f3zyMAT4:COgjjYbRXXti7qSkJBAfCWs3zyNT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652083255, "uuid": "9144dc4e-4dfb-4434-8089-20e74a7ea727", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652083255, "uuid": "01a3e784-6dd6-453e-8f63-e39551bf647a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652083255, "uuid": "6887ce5b-ca50-4e27-af3a-79e9b47c0e26", "value": "PO Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b0eef1-cfa5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652107066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107066, "uuid": "f93a7d9d-f5f5-4fcb-a310-de6801fd40fa", "comment": "Malware payload (Formbook)", "value": "efb141aec2d670561f84cec2b1bdad9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107066, "uuid": "051ea199-3e24-491f-9230-1345b6d7fc58", "comment": "Malware payload (Formbook)", "value": "f3795e8438d78333d6c4636837c023dff79aeddbb8d981407bec9f5ba2dc8d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107066, "uuid": "60b40c44-cf9a-4823-b303-0410593df0ef", "comment": "Malware payload (Formbook)", "value": "0c80c337d4b3c26c60bd29982f6d675c5d07b1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652107066, "uuid": "19de9392-d51e-41b8-a4c6-0369097cfeb0", "comment": "Malware payload (Formbook)", "value": "c37b4a219b07c84ec0e867d6aedc37fba410d2c7f0132d8e33a03529ba8cbc657e5f4fd9b2928aa02fc62675bcf5779b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107066, "uuid": "95fbe106-7d10-45c1-8148-fdc77b0e2bd2", "value": "T1E4348EABAF9C01AAECF45CB409539E7007B74D38CCD8570398DD362E8FBBA855032596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107066, "uuid": "1afe1a5e-d2b5-4f59-8f52-a216bf1c4e10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107066, "uuid": "fb7aa8b5-dc5d-424e-aec8-16dc4af4c812", "value": "6144:bRSGM7FO/Tl+oyCRNrbMpaWzF5UXV+bluH:bm7UrlNRVMpaWzF5UX8bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652107066, "uuid": "b2e9e2d2-bf63-41f2-94e8-2c52c7559b21", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652107066, "uuid": "2cf671f1-684b-4f38-aa62-06bab6058d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652107066, "uuid": "45cb64e7-73dc-4fd7-a04c-d2d11bf7ba46", "value": "efb141aec2d670561f84cec2b1bdad9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc105fb8-cf5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652075344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075344, "uuid": "e02ee883-832e-4233-be74-c79a532059fc", "comment": "Malware payload (Mirai)", "value": "ecb9ff77b486daf9691cec9da0cede73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075344, "uuid": "dec63516-e968-4d32-8702-ff18dd4dea74", "comment": "Malware payload (Mirai)", "value": "f4c70aee347883fe95d7c4e662d72c9c9975ddb682bedda4e175ab136aeb4a3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075344, "uuid": "2791292a-2bd0-46f1-ab2c-24a2b6697d9a", "comment": "Malware payload (Mirai)", "value": "fe012437668471c7b5fbf5b82d5d73aa0d5d51ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075344, "uuid": "d15a49b9-4c42-4854-b3b1-2da388873914", "comment": "Malware payload (Mirai)", "value": "b5bdcd0eb0d351cc4beab4a762d1495f9bdaf0e45745ea0b895599d17eb7c4284e4bf639e7330fd98fac12caa27c6119", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075344, "uuid": "a338355e-c6fe-4c2a-94b5-b83b5a55fe14", "value": "T13593A309BFA05EF7E8AFCC3345D92745288D655A21A83F79B930D928B21B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075344, "uuid": "78c43fd2-5947-4977-964e-93f04436478b", "value": "1536:a5DnSB+v5tjQm2r17xk49d6xZLu8vJ4TGo8S:a5TSB+v5tjQm21GFrvhrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652075344, "uuid": "c1eb84fe-7a0d-4c5d-8715-3af1cf646432", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652075344, "uuid": "02d9db3c-c20e-4fae-bf14-aafa77e974fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075344, "uuid": "a57c9224-d3b4-4240-98f5-a3c5278769fc", "value": "ecb9ff77b486daf9691cec9da0cede73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935f5829-cf79-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652088161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088161, "uuid": "605c9d9a-7aa8-4b97-be0f-c95dc35cdf24", "comment": "Malware payload (Formbook)", "value": "e3fc8bed30a95f62df7e584768c333f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088161, "uuid": "fafd1f8b-ee24-4b48-97bb-2e4e06a45458", "comment": "Malware payload (Formbook)", "value": "f59c7ddd5d3897e0cb1f4400a9b6913d1b07a08d41f93fc5fbdbb9c5be356cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088161, "uuid": "30b1dad5-d78a-4bc7-b187-ed7643c93e2e", "comment": "Malware payload (Formbook)", "value": "97b45f81fc54c6019c853d8a21f5aae235abab78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652088161, "uuid": "f091cdf1-810a-4c4a-8707-56ee701179ea", "comment": "Malware payload (Formbook)", "value": "20c409bd26b41c669f04fab8bb027903430b94ecd594e28512a75d38bccc37975aeb1ce196eeb3d3822a8d59cbf79424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088161, "uuid": "74bba9d4-2b23-4df2-afeb-c37f1be4c13c", "value": "T1913412566161C037E8631633093ABFAB23EEE2250178475B07546F4CBE3D641B90E7B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088161, "uuid": "905c777c-3968-433e-bf6b-871a60ec0fe2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088161, "uuid": "101eba3d-f925-439d-b3bf-fc0b036ea43c", "value": "6144:HNeZmC9kyZ1o5ve8g7ydhRcm6n2NTPFrvjGjzNVEx+:HNlCayDIfOyf5425FrvjGV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652088161, "uuid": "8bd432a7-966b-43e5-916a-f38d21714d36", "value": 236528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652088161, "uuid": "3de52236-c3c5-43f8-8eb5-e07bdb3ca601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652088161, "uuid": "54e5aed2-14aa-4623-8211-fae46027cd3c", "value": "TT COPY FOR APRIL SHIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7018f55-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652105078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105078, "uuid": "7bd0e3cc-4cc3-4475-a520-80713e2ef818", "comment": "Malware payload (AgentTesla)", "value": "0622ff353568cd86c631245343ec5f42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105078, "uuid": "25f29e56-7c43-4ee0-9fe2-08976ff79f8d", "comment": "Malware payload (AgentTesla)", "value": "f633e94a32ee469e98e49ebae27726a36e4ecd98c3ff0d2e4ed4b4c98e937063", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105078, "uuid": "430d8882-1767-4459-bd4f-4221c871abe9", "comment": "Malware payload (AgentTesla)", "value": "4a08393088456ebfbe1a7f46727c631b8b699a84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105078, "uuid": "128b50cc-9ccb-4275-89f9-2eccdd906dee", "comment": "Malware payload (AgentTesla)", "value": "b8420930378650f7c23a4ae8e2829d7cc7f8975f95eccd0e46d5136a016ea9f4406ec0505e53e1bdd0a5b6388e031353", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105078, "uuid": "97a23e32-0250-4bfd-b1ef-9206903e4c7e", "value": "T18673E07460238354D2E5CE756BFE02235E92EE63BE2E020952D4B3A8A43BE4C456B479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105078, "uuid": "e70fd452-ef1a-4904-84c5-96ecf5c694f2", "value": "1536:Y5BzFWosq71+OgQkZSrFIIcFGubaSULWARlx5uxfcS:Y3F1bR+JIoFGJry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105078, "uuid": "4795826f-37a8-4c46-b4b6-9dd3c3fc4c01", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105078, "uuid": "488ed157-ced3-4a15-86b3-b5a4aefa3f2b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105078, "uuid": "dc947615-7e7a-46a2-ba03-7f218f0644c2", "value": "QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387caad4-cf86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652093592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093592, "uuid": "bb93cae2-6378-42af-af33-dabac0c1b28e", "comment": "Malware payload (Formbook)", "value": "efd3902bf8f0c22633f75d661582a341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093592, "uuid": "f71eb7f9-1c79-4dbe-a699-f5ab24b28cf2", "comment": "Malware payload (Formbook)", "value": "f6acdf84ba27d835f11aaeaf29f71eab77a592fb6fea7a06d76bcd1d9228171c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093592, "uuid": "8f8d2024-bfef-437f-a67e-56c068a1a5a9", "comment": "Malware payload (Formbook)", "value": "c606c0ae2c7cb93a97af15f37c4c47d78a86c0f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652093592, "uuid": "d81b8386-9308-44c7-a91d-4a0e39749cdf", "comment": "Malware payload (Formbook)", "value": "5e842255404738b3afabddb0ae6a1597b9db969e72e9fce5e552037dfd542a372f5f73c369b4f1396ee287d583c9bc98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093592, "uuid": "17c88c08-301a-4e3e-8b74-d67198922f91", "value": "T173D4221EB6EA4767D37953F69281938003F2BD2E7111F7952CC23ACE19A7B4A0644F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093592, "uuid": "43d58a81-e63d-4aeb-be30-1c52262d9361", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093592, "uuid": "5202a58e-1baa-4da4-8e58-072a8032b185", "value": "12288:8GD52L2Id/hAnX/fRurpy57RSjELw3R2PbPptMqS0Ac7l19UnGHkOET8Yhl:dd29AnPwURSjELxg0A+1inzOMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652093592, "uuid": "9ce07f17-330d-421b-82ef-a8886b76d64e", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652093592, "uuid": "ea413afd-2f80-4b8a-9b19-de6121b62dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652093592, "uuid": "bf274ca7-dc85-465b-8975-0492f5818920", "value": "Bill of Lading.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c14269a-cf9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652104389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104389, "uuid": "ecab7709-deb9-45f7-b970-bf879e178c27", "comment": "Malware payload (Formbook)", "value": "826afc2b3a8f621a06612694758b0999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104389, "uuid": "05b25b46-7fac-4428-8ca6-b84afc90d577", "comment": "Malware payload (Formbook)", "value": "f7eca54a50a6a758f8a52f950636e4554a5a1b5a070d9f51351febabc536f381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104389, "uuid": "a0bbe7c3-aa5e-42ed-83fb-6b17200ebb9b", "comment": "Malware payload (Formbook)", "value": "2b676b1a71d5a68cc5341dada35bf3de241018f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652104389, "uuid": "d11d4043-6449-4904-acdd-2de42fe51c0d", "comment": "Malware payload (Formbook)", "value": "57a6b1a23bf20f6768f0bd655151e44a90b2a1ba843d0f4e2c54b17aaf4b19849a6b21954207b07ff0d1f35c33f00f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104389, "uuid": "c7ada74d-4704-43f4-ad59-e9326ed4ae76", "value": "T1FB44120E71A1C8D3D9F116725F7A93FB5BBF941822706A0B5350BE4E3E74A42D60DB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104389, "uuid": "6dd19426-02c9-4e91-93bd-8b5a3d43525c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104389, "uuid": "6761e589-112c-4698-b56c-7d221af5cb26", "value": "3072:l1NjcVVnLpPunb1CMn3LENn9W5xw47uxLeKv8KDCZo0jHyC4WM9257TUmH2/LZNO:HNeZm1CS3Fk47uAKEZSlCvL577HQRHi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652104389, "uuid": "c7b04d06-ffde-4b94-b6bc-ae0bf8308728", "value": 254685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652104389, "uuid": "9df5847a-a28e-4c21-86fe-5b8153459d78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652104389, "uuid": "fb3baef2-d911-4453-8f27-bbd88694bfeb", "value": "odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8a1c50-cfb0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652111584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111584, "uuid": "b2190854-08bf-430e-abed-c157c61a69d0", "comment": "Malware payload", "value": "dc71b74a19d7d10ab964b3c7f83c0dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111584, "uuid": "fd6081b2-c987-4dd9-8d70-12ec3d94672e", "comment": "Malware payload", "value": "f92693be20b760d1f24228bf91056368c06f33faeaf8fad6517115036d1f37c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111584, "uuid": "5dd06194-e427-4e63-b9e1-46bb8d7bd7fe", "comment": "Malware payload", "value": "288e2d33cf1f414fb608c43a7f594d17010ced61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652111584, "uuid": "59ea18ce-c635-4dce-9e90-44745fb022ee", "comment": "Malware payload", "value": "ec78cb662df4faab896e54de1b65379034578450e7853184e6f2a550fcbebccbf8a994419eb7e36b3057a0585d733100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111584, "uuid": "0fb94485-d693-4e24-b970-4c7da2b13105", "value": "T163050662F1E2E076D022163C6C467D7A97F66F20DC3AD84199CDE9C996F0DE12F26342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111584, "uuid": "dda97884-e459-4b54-ac4b-562426573ff6", "value": "600892445f7607ae92078532b10fb4d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111584, "uuid": "bc1da884-cf0a-4587-9408-2b251b11ef00", "value": "12288:fUrmxBD2Hw/5pltFMRu9+D/0lHOwIo5TU8xNG/9r4FKI4/8l1:fUzQ7ltx9ycY65TU8bswJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652111584, "uuid": "2535efed-d634-4bef-8745-67306bfeaf86", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652111584, "uuid": "f2feb0da-1026-4880-9d0d-f732737053ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652111584, "uuid": "cb6bf1a4-4026-44f8-b21c-2e1cd79e6db4", "value": "CHANGE OF ACCOUNT RUSH TO DESK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd69c45a-cf5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652075454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075454, "uuid": "1fd34a07-0dc4-4c88-9998-47e4307868f4", "comment": "Malware payload (Loki)", "value": "e4d884823ad90ecb09fd861992e147b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075454, "uuid": "e194184c-cd5a-4369-87d3-7999da70d430", "comment": "Malware payload (Loki)", "value": "f98336bc1d2a5f5589dbc825b6e7024465848a4bfcb9ec671d6c152899e6fa27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075454, "uuid": "47f0fa0f-52ed-4e80-aa4d-ddeb29241a85", "comment": "Malware payload (Loki)", "value": "51cf4c9a06f8f444fc74320aacc1026f9c910bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652075454, "uuid": "6daf9a17-12d0-43ca-8b17-f57dfc761840", "comment": "Malware payload (Loki)", "value": "8be28cd45218fcecdb850d3b13e3e98c8947d45fb5bc33a6a3ebf9ee447289d2710c6282dd606f1b7a73efb6fe47186c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075454, "uuid": "1d2a2452-fcac-4989-b37e-f9043fe24307", "value": "T1FF84124AABED8227D47E0AFFA472120213B578938D53D63A1DDA24CA1DB3B0C4B51F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075454, "uuid": "d4c6fbec-f3f3-4b2c-8d4a-2c41fdf6d752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075454, "uuid": "04832f03-440e-4f46-a5a9-96286ac21e0b", "value": "6144:sa4OnSBX6nERVYTvVBrJT3UQm2uEGFr71gJeVmvDuxNL97newLsIW69M:LFnAKERVsdBlTEV71Q+qKrLxeDN4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652075454, "uuid": "a74a2553-4a88-42f0-abb2-b704e432ecde", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652075454, "uuid": "ecdae971-08e6-4320-bb26-d244c43ce869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652075454, "uuid": "4bdcdfd8-ffe4-4110-b99f-961eef300df1", "value": "Outstanding-SING YICK CO., LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1250c63-cfa0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652105042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105042, "uuid": "98c96f98-2650-45f9-be5d-0cced1f63293", "comment": "Malware payload (Formbook)", "value": "040830437ed7971e85937f51293c028d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105042, "uuid": "eefc2e53-961b-4e65-afb4-d60b0724a0b5", "comment": "Malware payload (Formbook)", "value": "fa834464f2535546c9d0aa5989dd128ec42e5645e1b9cb4b07ff3516d536425e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105042, "uuid": "8422bf3d-8bbe-45d6-b5e0-d6e1c6b0529a", "comment": "Malware payload (Formbook)", "value": "3bbf8e126037519acff8a1f9cdfc3cc72f60c6e1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652105042, "uuid": "88cd6404-e0bc-4b6f-a7b6-3621ab2f2446", "comment": "Malware payload (Formbook)", "value": "39536e6fd574d7aaa6f215370f1ae0768bde32e1f9f41d861ef60717b7274b71498bd0a75b43101ae9ac17f1c804bd9c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105042, "uuid": "427a452f-9a6f-4bff-8bcb-5bfc72bddeb5", "value": "T15B24125327915968E07AEF748055C9BEAF0FED33686A12257351B943AC34C17B03CD76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105042, "uuid": "30a7bedf-fb46-432b-97a6-86d6f0517442", "value": "3072:XmEoypQKYP5yYC05LDshWS5QglVzs03UZDMNhWGAM4rBZkMwywcDuiUiHiP+BixC:ZqkyDshfWKdx3UKiGlsvkFMDVHeIIB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652105042, "uuid": "00d5cbb4-6af0-458a-8ff4-222e4eae493e", "value": 211448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652105042, "uuid": "245fff75-0744-4605-9b9e-e374500db585", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652105042, "uuid": "c6d9db95-7ebd-41c5-8e35-bd0834f78c70", "value": "_SOA_090422.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fbac01-cfe4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652133898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133898, "uuid": "ef6c310a-a374-4464-b845-f70a20ed37e4", "comment": "Malware payload", "value": "e9aa5bbc0a6e1524899de339ea631acc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133898, "uuid": "e28b583e-1906-4e14-9dd3-f2d28dd05e87", "comment": "Malware payload", "value": "fb399a624795230353bfdeb33ec25c423ea42e96813b7b8fd699af8ccd4efbba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133898, "uuid": "68b1b0f0-88b9-4108-914d-9f33c01eb0b8", "comment": "Malware payload", "value": "5aa5f3e4c5d06ff1e07b08015e3babba64fbec69", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652133898, "uuid": "366daeb3-754f-4cd4-a491-5e5a48157951", "comment": "Malware payload", "value": "a1f64ee42bdaa9b9cc7f23c98140733475fb27fef8fb90ebfd2d5285268c6c9dec60d822a7f5c6c25ae66e7173242959", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "LockScreen", "colour": "#BAFD3F", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133898, "uuid": "66d00ffe-483d-425e-886b-1f233bdeb06d", "value": "T18136BE06F65DBE17C8F29835125B87737925ED88132192772509F339BEB7BC98E06AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133898, "uuid": "389d14ac-8311-4f50-868b-5c891672a4e3", "value": "98304:MxKTfjTC9YH16PCFDNf+itQkQK7OxJfA5wTkJVd0WpkOSAUT:wKzC9YVLUgQ8sJoiTkP1qOrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652133898, "uuid": "4ba02f39-a827-4def-8014-8c264ad4df60", "value": 5302154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652133898, "uuid": "08c9bca1-c69b-4134-8e53-4f9945a76551", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652133898, "uuid": "e80f9136-227e-4c25-ba88-dac44809b95e", "value": "ezrail59.APK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4baf2a-cfbf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652118292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118292, "uuid": "7c09c316-10fd-4647-963d-2c9cd12b8400", "comment": "Malware payload", "value": "68b94ac1fadefc5e4cd000c4e348a064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118292, "uuid": "ddbe7965-966f-4842-b683-c80908dc0e91", "comment": "Malware payload", "value": "fc314c437e0b441021d0843f391d0b6714a91098a594793d51ac9c89b3ca43ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118292, "uuid": "fca3d9c8-bdfc-421f-8a18-7a4e460f7563", "comment": "Malware payload", "value": "18b74b40e694d95af8c26cd37effa246c75b01fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652118292, "uuid": "c879f8d7-22a8-42ec-b221-764791c89f8c", "comment": "Malware payload", "value": "717c1ba4581a709a456d7873740b7c8493f5b992729788ec6a0e7c2038757688bf78d9b61c13be12403eabedddb2c46c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118292, "uuid": "ad69d33c-186c-4e2b-afd7-070c162a4105", "value": "T173052666F1E3D076D122163C0D167D7A57B27F20DD3AE841A9CDE8C896F4EE12B26342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118292, "uuid": "b61a9c19-5339-4a2e-89e1-2bcdb5fd883d", "value": "600892445f7607ae92078532b10fb4d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118292, "uuid": "99d5dc91-6c44-4d92-997b-75991a140445", "value": "12288:fUrmxBD2Hw/5pltFMRu9+D/0lHOwIo5TU8xNG/9r4FKI4/8X1:fUzQ7ltx9ycY65TU8bswJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652118292, "uuid": "905d9a04-ad33-4b5e-90d2-65ee4487343f", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652118292, "uuid": "63b18c37-9045-43f2-8d27-459a512ee3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652118292, "uuid": "877d55f7-2de4-4ed7-bdc3-ca638d71b1a8", "value": "SecuriteInfo.com.Win32.Rattler-ACryp.1575.9369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b4784c-cf7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652090760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090760, "uuid": "92731ebc-2230-4a7a-9c34-55268c78d120", "comment": "Malware payload (Mirai)", "value": "2af0121dcb057bc5778dc99e5b1073cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090760, "uuid": "2ce33948-0911-497d-8d6d-bffc1aa4ab5c", "comment": "Malware payload (Mirai)", "value": "fd543c38e0c4aab79d648ca255cdbfef79666e1629d2f9be6486ebc9ddd00b4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090760, "uuid": "c05df6ec-9c53-4da6-8b58-8a318927a49a", "comment": "Malware payload (Mirai)", "value": "f8a72e669634e566ce3a9a4f09c24e5f23f9c9a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652090760, "uuid": "05e16be4-ab31-40f8-af34-8005b8866a6b", "comment": "Malware payload (Mirai)", "value": "d99c06d3ef44bff94c305d68d4e374739207204fb3450c84d4f6edd484b48172caff632f9abcd8859108e892aaebca73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090760, "uuid": "85ffb1aa-4f47-44c1-85f6-2565a72dd36a", "value": "T14E831846F8818E16C5C513BAFA2E118E331317B8E2DEB2269D14AF2077CB92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090760, "uuid": "6597710e-51d2-4124-bab6-9ecf588dbd19", "value": "1536:2Rnx6mu/B72ccGKj0ATxSaCAHIkgqPDIVFmEiNYXHuWEIraqwtL4IdiZbrVDdu1k:q6poGg0KxpCtkgcDcniSXu1MambrVDdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652090760, "uuid": "f2176a38-7398-4b92-817f-4b793d77abd9", "value": 87180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652090760, "uuid": "a523ade4-a9bb-4ae0-b041-000de31fc6c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652090760, "uuid": "1ac72ba0-159e-4314-b386-38f41f95168d", "value": "2af0121dcb057bc5778dc99e5b1073cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7461c7-cf6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652083450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083450, "uuid": "248d6d28-0e5c-47c7-8570-8bde3fe410a2", "comment": "Malware payload (Formbook)", "value": "376ee2cd76269d4746d440b2b0263f5b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083450, "uuid": "06414042-53b6-4cd7-ac89-438c27a9d5c8", "comment": "Malware payload (Formbook)", "value": "fda413c75736cbef772903782bf93d919cb4857a6f394458bb1fbf4e273612fd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083450, "uuid": "0a2969ca-b534-4c57-a6bd-ef2347efed0a", "comment": "Malware payload (Formbook)", "value": "9b863b0db1d4e64948b045363f60bab13f0c65e1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652083450, "uuid": "df78cd50-fac2-4f5e-96cd-651d70c8ecf0", "comment": "Malware payload (Formbook)", "value": "aee6b0ba899c812cc436e28ed49098d9c7ff5dfbbcd615e869ae03b82e28d941e2ed428f1c7ebb892a3b283a7e05949d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652083450, "uuid": "be3c8a5a-79a6-41c2-98c7-1526f4c281db", "value": "T14B75EB31B132BA87C3160561565FBE86531CBE43B2C55F8CA04DFBF82CE6CA69342D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652083450, "uuid": "64d96543-e53b-41a2-bbde-ba20f878f312", "value": "1536:gch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bA:4U0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652083450, "uuid": "9f90a8ed-2272-420a-b14d-6be0631f46ff", "value": 1677865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652083450, "uuid": "1a4a85b0-42f9-4daf-8fe3-02ede76df11b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652083450, "uuid": "c26bddc1-ab91-4f8d-b5f4-4cf7ef32b72d", "value": "RFQ-B20461.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9a3adb-cf74-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652086161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086161, "uuid": "6ef585ad-b69e-4ef8-8e36-b1031e141751", "comment": "Malware payload", "value": "e1d7f562abffed392861c7e1274aef5e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "qksms", "colour": "#3DF755", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsGrab", "colour": "#324103", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086161, "uuid": "48941211-228d-4291-b901-ef68a37bb96c", "comment": "Malware payload", "value": "fe9d17cdbab9d95df5e2e10a6fcf78303cbd8b94f038471ac066657f4adf6dcd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "qksms", "colour": "#3DF755", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsGrab", "colour": "#324103", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086161, "uuid": "90e1d6a1-97f2-4e03-9c7a-c4b52852cbcb", "comment": "Malware payload", "value": "65f05cf91c9fc766ddbcd2815a26f7eca9f6872d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "qksms", "colour": "#3DF755", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsGrab", "colour": "#324103", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652086161, "uuid": "f5b4dd10-12cd-4ef1-b1de-77a1f797eb27", "comment": "Malware payload", "value": "10c8b7f9cc877732ef5b306d12078af8d7edf340658ac519f37ff34068516348c68eeb8c1ffcc1f59186583eb469c1ec", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "qksms", "colour": "#3DF755", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsGrab", "colour": "#324103", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086161, "uuid": "edc158e5-05cd-46ac-841e-7dbd1f5457c0", "value": "T124273302D6AD644BF5F7A9301168D447DB5CA68CAD6DF21E0A14F9C86FB78C03BCAD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086161, "uuid": "71f8e76c-1aa6-4cf9-ae58-7de9db25f8f9", "value": "393216:LB45nr9JUOdEpSic+HkbGVsR84hfhtL/34PLTOoSxMmVUenKKlVXsrpAPW+:t4prv5Gpa+HbS7LNRNKKrXgpUW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652086161, "uuid": "7f497528-000f-43da-b432-10774061deca", "value": 21944786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652086161, "uuid": "dd02f4a9-8e04-4df9-ba76-eb1b1388812c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652086161, "uuid": "d5c5c55e-8c82-4edc-96ba-79328ccccfc8", "value": "ISP-SmsSicurezza.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5570fc7-cf71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652084782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084782, "uuid": "05a203c9-c65b-4b02-b176-08f8a6dbbfef", "comment": "Malware payload (Formbook)", "value": "dd19b4b0078aaf461d473ee0ddb6bf81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084782, "uuid": "2a0109eb-55ae-4809-af89-4e0c9299cf2a", "comment": "Malware payload (Formbook)", "value": "ff933a6edd8bba32d262ab02ef5a2849b12b3ddcd3fc98d2aa9ec1d720dc235f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084782, "uuid": "4662669b-ef70-491c-845f-d4f87e52c8f1", "comment": "Malware payload (Formbook)", "value": "f0ea0126bd0244ff3e5b5ca2ba70f277c26c215d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652084782, "uuid": "6214314c-5e29-468f-b64d-8f5d6ddf09b7", "comment": "Malware payload (Formbook)", "value": "55d3e497f23dbd5b2ab49a553953adccd7fbd7eb0d168c9812c7a62779441b2919e6507c71ce5ffe0e58519d15f1464b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084782, "uuid": "2ec7d4cf-cd34-4e2f-a3a3-e6570d57ca3a", "value": "T1C42412191761C86BE9E38A719E3E0376AEAD591335E80B0F1720AD4FBD22941EC5F316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084782, "uuid": "2d43b92b-b37f-44c5-9eeb-1e9d8667cc4b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084782, "uuid": "1f085f23-ea8a-4cec-9783-f7af09fc450d", "value": "6144:HNeZmw89OIn8BeQW1oWp262qp7TVt1tztN:HNlwpIns38oWp2q1TBtzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652084782, "uuid": "44a63433-2857-4c73-a83d-482ec6e3b795", "value": 219670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652084782, "uuid": "84d215e2-e694-4a08-9307-a9f94bbd3af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652084782, "uuid": "de9bb21e-87c9-4e6e-84f9-44e7bd7a0d5b", "value": "Factura_834.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fc9807-cff0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652139116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139116, "uuid": "585e4519-0590-421f-b707-0a4bd9076720", "comment": "Malware payload (Formbook)", "value": "6b216b6cc15be9968b6c6eef5fa8591a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139116, "uuid": "4a6c9d53-bdaa-4e06-b213-7737e1b6a64a", "comment": "Malware payload (Formbook)", "value": "ffbd8cb5a8779c934324bbee870d6b1d7549d4c6eb358cd67b923aa8a5b21a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139116, "uuid": "348fcea2-62ad-4026-9c48-b2fec9534f3b", "comment": "Malware payload (Formbook)", "value": "95a56eb69683dfb5ef9710cc4ddf28c3d2f6ac85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652139116, "uuid": "a83dedda-d813-4923-8130-0044e8365ec1", "comment": "Malware payload (Formbook)", "value": "7dbe4c208ec2c1d9d4abe25311308802343451e99cce95daf600450ebac76ca65b6ce5cbd1bc2a79246b811c503f55d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139116, "uuid": "92350da7-3870-4e80-8526-3c8373aaa739", "value": "T158A46D3EF21FF546C2C4B178E9D5420902AB5D9C3C5CA5A47468FA21E0BAD48BB43F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139116, "uuid": "156c027a-2cd5-4410-b56d-6069e354d9b2", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139116, "uuid": "aa80cb71-987d-466c-8b93-4d7aad5a0ab6", "value": "6144:sNeZ/ppppppprF2pY8AQdK/vx4yN/fgCIlT1lEI3jEyYgh:sNqppppppp52vAGq7HmRz3jEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652139116, "uuid": "2c8733b0-70d3-4068-8fa9-c998279ec003", "value": 480388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652139116, "uuid": "d4adeb8f-7e08-4d14-a8c5-32a60e5ad119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652139116, "uuid": "8d36c80d-8863-47ab-aa82-93271e462845", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }